The Google exchange, step by step

OAuth with Google · lesson 3 of 9 · 5 min read

The real URLs and parameters, walked end to end.

Open this lesson in the learning hub

Key points

  • The flow is the standard authorization code flow, with Google as the authorization server.
  • scope=openid is what makes it OpenID Connect and produces an ID token.
  • state still must be generated and checked - Google does not do this for you.
  • nonce is echoed into the ID token, which binds the token to your specific request.
  • The token endpoint returns id_token, access_token and sometimes refresh_token together.

Validate the ID token fully, then issue your own session - do not keep using Google tokens as your auth.

Setting it up in Google Cloud Never key your users on email

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth with Google course, and every lesson in it is listed on the OAuth with Google contents page.