Setting it up in Google Cloud

OAuth with Google · lesson 2 of 9 · 5 min read

The console steps, in order, and the setting that causes most first-attempt failures.

Open this lesson in the learning hub

Key points

  • Create a project, then OAuth consent screen, then Credentials → OAuth client ID.
  • Pick the right client type: Web application has a secret; SPAs and mobile use PKCE instead.
  • The authorised redirect URI must match what you send exactly - scheme, host, port, path, trailing slash.
  • While the consent screen is in Testing, only listed test users can sign in - everyone else sees an error.
  • Requesting sensitive scopes (Gmail, Drive) puts your app into Google’s verification process, which takes weeks.

The redirect URI must match byte for byte, and offline access needs prompt=consent to be reliable.

Sign in with Google: what you actually get The Google exchange, step by step

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth with Google course, and every lesson in it is listed on the OAuth with Google contents page.