Sign in with Google: what you actually get

OAuth with Google · lesson 1 of 9 · 4 min read

Two different tokens come back, and mixing them up is the classic first mistake.

Open this lesson in the learning hub

Key points

  • Google implements OAuth 2.0 plus OpenID Connect, which adds identity on top of authorisation.
  • You receive an ID token - a JWT proving who the user is. This is what logs them in.
  • You also receive an access token - opaque, for calling Google APIs on their behalf.
  • For plain sign-in you need only the ID token; the access token matters if you want Calendar or Drive.
  • The ID token is signed by Google and validated against Google’s published JWKS keys.

ID token = who they are. Access token = what you may call at Google. They are not interchangeable.

Setting it up in Google Cloud

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth with Google course, and every lesson in it is listed on the OAuth with Google contents page.