Google OAuth redirect URI for local development
For local development, set the Google Cloud Console redirect URI to http://localhost:3000/api/auth/callback/google.
Better Auth · Authentication · all subjects
social sign-on/google
21 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Google OAuth redirect URI for production
For production, set the Google Cloud Console redirect URI to your application domain, such as https://example.com/api/auth/callback/google. If you change the base path of the auth routes, update the redirect URL accordingly.
Creating Google OAuth credentials in Cloud Console
To create Google OAuth credentials: (1) Open Google Cloud Console → APIs & Services → Credentials, (2) Click Create Credentials → OAuth client ID, (3) Choose Web application, (4) Add redirect URIs for both local development (http://localhost:3000/api/auth/callback/google) and production (https://your-domain.com/api/auth/callback/google), (5) Copy the Client ID and Client Secret into environment variables.
Google provider configuration with clientId and clientSecret
Configure the Google provider by passing clientId and clientSecret to socialProviders.google in the auth configuration. Example: socialProviders: { google: { clientId: process.env.GOOGLE_CLIENT_ID, clientSecret: process.env.GOOGLE_CLIENT_SECRET } }
Better Auth baseURL configuration requirement
You must configure the baseURL in Better Auth to avoid redirect_uri_mismatch errors. Better Auth uses this to construct the OAuth callback URL sent to Google. Set BETTER_AUTH_URL=https://your-domain.com in .env file (recommended) or pass baseURL directly in the auth config.
Sign in with Google using signIn.social
To sign in with Google, use authClient.signIn.social() with provider set to 'google'. Example: const data = await authClient.signIn.social({ provider: 'google' });
Sign in with Google ID Token
Sign in using Google ID Token by calling authClient.signIn.social() with idToken object containing token and accessToken properties. When ID token is provided, no redirection happens and the user is signed in directly. Example: await authClient.signIn.social({ provider: 'google', idToken: { token: googleIdToken, accessToken: googleAccessToken } })
Cross-platform sign-in with multiple Google Client IDs
For cross-platform sign-in (Web, iOS, Android), pass an array of clientIds to accept ID tokens from multiple platforms in the same Google Cloud project. The clientId array expands ID token audience verification only; the authorization code flow still uses the first entry paired with the single clientSecret and redirectURI.
Cross-platform Google sign-in configuration example
Configure multiple clientIds for cross-platform sign-in: socialProviders: { google: { clientId: [ process.env.GOOGLE_WEB_CLIENT_ID, process.env.GOOGLE_IOS_CLIENT_ID, process.env.GOOGLE_ANDROID_CLIENT_ID ], clientSecret: process.env.GOOGLE_CLIENT_SECRET } }
Mobile app Google sign-in with ID token forwarding
In a mobile app using native Google SDK, obtain the idToken and accessToken, then forward them to Better Auth: const { idToken, accessToken } = await GoogleSignin.signIn(); await authClient.signIn.social({ provider: 'google', idToken: { token: idToken, accessToken } });
Restrict Google sign-in to Google Workspace with hd parameter
Set hd parameter on the Google provider to require a verified Google Workspace hosted-domain claim. Example: hd: 'company.com'. Set hd: '*' to allow any Google Workspace hosted domain. Tokens with no hd claim are rejected whenever hd is configured.
Google Workspace hosted domain validation in custom callback
A custom getUserInfo callback replaces Google's built-in hd check. When using a custom callback, validate the hd claim from the trusted provider response and return null when it is missing or does not match. Direct ID-token sign-in follows the provider's ID-token verification path, while Google One Tap enforces the configured hd separately.
Always ask user to select Google account with prompt parameter
To always ask the user to select an account, set the prompt parameter to 'select_account' in the Google provider configuration. Example: socialProviders: { google: { prompt: 'select_account', clientId: ..., clientSecret: ... } }
Request additional Google scopes using linkSocial
To request additional Google scopes after initial sign-up (for Google Drive, Gmail, or other services), use authClient.linkSocial() with the same Google provider and specify the scopes array. Example: await authClient.linkSocial({ provider: 'google', scopes: ['https://www.googleapis.com/auth/drive.file'] });
Additional scopes linkSocial version requirement
Better Auth version 1.2.7 or later is required to avoid 'Social account already linked' errors when requesting additional scopes from the same Google provider.
Get refresh token from Google with accessType and prompt
Google only issues a refresh token the first time a user consents. To always get a refresh token, set accessType to 'offline' and prompt to 'select_account consent' in provider options. Example: socialProviders: { google: { clientId: ..., clientSecret: ..., accessType: 'offline', prompt: 'select_account consent' } }
Getting new Google refresh token requires revocation and re-authorization
If you want to get a new refresh token for a user who has already authorized your app, they must revoke your app's access in their Google account settings, then re-authorize.
Google sign-in hosted domain wildcard support
Google sign-in now accepts hd: "*" to allow any Google Workspace hosted domain while still rejecting tokens with no hosted-domain claim. Google One Tap now applies the configured Google hosted-domain restriction before creating a session.
Google One Tap disabled for new users when sign-up disabled
Google One Tap no longer creates new users when sign-up is disabled for the Google provider.
Google One Tap requires configured client ID and validates issuer
Google One Tap now requires a configured Google client ID and rejects the sign-in callback when none is set. A Google ID token issued for a different application is no longer accepted. Set the client ID on the oneTap plugin or on socialProviders.google.
oneTapClient preserves type inference
oneTapClient() no longer collapses createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.