Documentation/Integrations/Google Sign-In for Your App

Google Sign-In for Your App

Create a Google OAuth client, connect it to your Supero project, and show a Continue with Google button on your app.

How It Works

Each project uses its own Google OAuth client, which you create in your Google Cloud account. Once it is connected, your app shows a Continue with Google button on its login page. You do not need to change code. Apps last published before August 2026 must be published again. Setup takes about 10 minutes.

⚠️ Google sign-in only works for people who already have an account in your app

The button signs in existing users of this project whose Google email matches. It does not create accounts. Admin roles cannot use it. An email that signed up for Supero itself cannot use it, and an email used in another Supero app may be refused. See Who Can Sign In.

What You Need

•A Google account with access to Google Cloud Console.
•Your published app's address. Publish first, open the live link and copy its address, such as https://live-acme-store.supero.live. Do not build it by hand, because long names are shortened. Do not use a preview address.
•Permission to enable and configure integrations in the Supero console.

Your redirect URI is that address followed by /auth/google/callback, such as https://live-acme-store.supero.live/auth/google/callback. You enter it in both Google and Supero, and the two must match exactly.

Step 1: Create the OAuth Client in Google

1
Choose a Google Cloud project
Create one or select an existing one.
2
Set up branding
Open Branding. Enter the app name, user support email and developer contact email, then save.
3
Choose the audience
Open Audience. Choose External for any Google user, or Internal for your own Google Workspace only.
4
Create the client
Open Clients and click Create Client. Set Application type to Web application. Under Authorized redirect URIs, add your redirect URI, then click Create.
5
Copy the credentials
Copy the Client ID and Client secret. Google shows the full secret only once. If you lose it, rotate it on the client.

Step 2: Connect It to Your Supero Project

1
Select your project
In the console, select the project your app belongs to. The configuration applies to that project only.
2
Enable the service
In the sidebar, open Integrations and select Google OAuth (Sign in with Google). Click Enable Service.
3
Enter the values
Open the Configuration tab and fill in the three required fields below. Leave the others as they are.
4
Save
Click Save Configuration. You should see "Configuration saved — service is ready!"

Field	Value
`google_client_id`	The Client ID from Google.
`google_client_secret`	The Client secret from Google.
`redirect_uri`	Your redirect URI, exactly as you entered it in Google.

ℹ️ Fields that do not affect the button

allow_signup, default_role, default_tenant, default_project and scopes do not change the Continue with Google button. It never creates accounts and always requests openid email profile.

Step 3: Test It

1
Open your app's login page
Wait a minute, then reload it. Continue with Google should appear. It is on the standard login page; a login page you wrote yourself must render the GoogleSignInButton component.
2
Sign in with a real user
Use a Google account whose email belongs to an existing non-admin user of this project and is not your Supero login. Create a test user first.

Step 4: Open It to Real Users

Open Audience and click Publish app, so the status reads In production. Supero requests only basic scopes (openid, email, profile). Your app's name and logo appear on the consent screen only after Google's brand verification.

Who Can Sign In

Person	Result
Existing user of this project with the role `tenant_user`, `viewer`, `customer`, `user`, `member` or `guest`	Signed in.
No account yet	Not signed in. Create the account first, through your app's sign-up or an admin, with the same email.
Any other role, including admins and roles your app defines	Not signed in. They use their password.
Email that also has a Supero console account	Not signed in. Use password sign-in.
Email that also has an account in another Supero app	May be refused. Use password sign-in.
Google email not verified by Google	Not signed in.

⚠️ Where a refusal shows

Apps published with Supero SDK 3.7.13 or later show the reason under the button. On older apps the pop-up closes with no message, so publish the app again. The exact reason is in the browser console, as [supero] Google sign-in failed.

Using a Custom Domain

First connect the domain and wait until its status is Live. See Custom Domains. Then, in Google, add https://www.yourbrand.com/auth/google/callback to the same client's Authorized redirect URIs.

Leave redirect_uri in Supero set to your app's live-….supero.live address. Supero uses the custom domain's callback automatically for visitors on that domain. Add one URI per domain, and never use a wildcard. The app must have been published with Supero SDK 3.7.9 or later, so publish it again if it is older.

Troubleshooting

Problem	Cause and fix
No Continue with Google button	The project has no complete configuration. Check that you are on the right project and that the service shows Active, then reload after a minute. A custom login page must render `GoogleSignInButton`.
Google shows `redirect_uri_mismatch`	The URI in Google differs from what Supero sent. Compare the scheme, host and path, and check for a trailing slash. On a custom domain, check that its callback is registered in Google.
Google shows "Access blocked"	The app is Internal and the account is outside your organization. Or the app is in Testing: add the account as a test user, or publish the app.
A message under the button, or the pop-up closes with no message	See Who Can Sign In. Check the browser console for the exact reason.
The pop-up closes and the browser console says "Google token exchange failed"	The Client ID or secret in Supero is wrong. Copy them again, or rotate the secret in Google. Saving only checks that the fields are filled in.
Button shows on a preview address but sign-in does nothing	Sign-in works only on the address in `redirect_uri` and on Live custom domains. Test on the live address.
Works on the live address but not the custom domain	The domain is not Live, or its callback is not registered in Google, or the app needs publishing again with a newer SDK.

← PreviousWebhooks & Events Next →Managed Integrations & Provider Catalog

On this page