Google OAuth

Setup

1. Go to console.cloud.google.com
2. Create a new project (or use an existing one)
3. Navigate to APIs & Services - Credentials
4. Click Create Credentials - OAuth client ID
5. Application type: Web application
6. Add authorized redirect URI: http://localhost:3000/api/auth/callback/google (development) and https://yourdomain.com/api/auth/callback/google (production)
7. Copy the Client ID and Client Secret

Environment variables

AUTH_GOOGLE_ID=your-client-id.apps.googleusercontent.com
AUTH_GOOGLE_SECRET=your-client-secret

Callback URL

The callback URL must be registered exactly in Google Cloud Console:

# Development
http://localhost:3000/api/auth/callback/google

# Production
https://yourdomain.com/api/auth/callback/google

Backend user sync

Google sign-in does more than redirect through NextAuth. On successful OAuth login, the auth callbacks create or update a canonical backend user record and then reload the stored values back into the JWT and session.

Smoke test

1. Open /login or /register.
2. Click the Google button and complete consent.
3. Confirm redirect to /dashboard.
4. Confirm logout returns you to /login.
5. Verify the backend user record exists or updates correctly for the Google email.

Removing Google OAuth

If you don't need Google sign-in, remove it from providers in lib/auth.ts:

providers: [
  Credentials({ ... }),
  // Remove or comment out the Google provider:
  // Google({
  //   clientId: process.env.AUTH_GOOGLE_ID,
  //   clientSecret: process.env.AUTH_GOOGLE_SECRET,
  // }),
]

You can also remove AUTH_GOOGLE_ID and AUTH_GOOGLE_SECRET from .env.local if unused.