By configuring social login providers, your application users can conveniently log in or register using their own Google accounts without needing to remember additional passwords. RootAuth currently supports Google login and provides two configuration methods: Shared Credentials (for testing) and Custom Credentials (for production environments).

Path: Log in to the RootAuth console → Navigate to the target application → Click Configuration in the top navigation bar → Select Application Management – Authentication Configuration → Choose Providers

1. Feature Overview

RootAuth's social login feature enables you to quickly integrate Google account login, enhancing the user experience. The system provides two configuration methods:

Shared RootAuth Credentials: No need to apply for OAuth credentials yourself; can be used directly for testing to quickly experience the Google login process.
Custom Credentials: You need to go to the Google Cloud Console to apply for your own OAuth Client ID and Secret. Suitable for production environments, providing full brand control and higher security.

2. Applying for a Google OAuth Client Account

To integrate Google login into your application, you first need to create an OAuth 2.0 client in the Google Cloud Console. Follow the steps below (skip if you are already familiar).

Step 1: Access the Google Cloud Console

Open the Google Cloud Console and log in with your Google account. If you don't have an account, please register first.

Step 2: Create or Select a Project

At the top of the console, click the project dropdown menu. Select an existing project or click "New Project" to create a new one, filling in the project name and other information. Ensure the current context is the project you intend to use.

Step 3: Navigate to "APIs & Services" > "Credentials"

In the left navigation menu, select "APIs & Services", then click "Credentials".

Step 4: Configure the OAuth Consent Screen (If First Time Use)

On the "Credentials" page, if prompted to "Configure Consent Screen", click it. If it indicates that the Google Auth Platform is not yet configured, click "Get Started".

You will enter the project configuration page. Fill in the necessary information, such as:

App name
User support email
Audience (select "External" for general applications)
Developer contact information

Then click "Create".

Step 5: Create an OAuth Client

On the "Overview" page, click "Create OAuth Client ID" and configure the relevant information.

The system will prompt you to select an application type. For most web applications, choose "Web Application" and fill in the following information:

Name: Give your client an easily identifiable name, e.g., "My Application - Web".
Authorized JavaScript origins: Add your application's frontend domain (e.g., https://yourdomain.com) and local development addresses (e.g., http://localhost:3000). This helps prevent cross-site request forgery.
Authorized redirect URIs: This is the address Google redirects to after user authorization. You need to fill in the redirect URI obtained from the RootAuth console. Ensure this is entered accurately; otherwise, the authorization flow will fail.

Step 6: Create and Obtain Credentials

Click the "Create" button. A popup will immediately display your Client ID and Client Secret. Be sure to copy and securely store these two values; you will need to enter them in the RootAuth console later.

Client ID: Used to identify your application; it is the application's public identifier.
Client Secret: Equivalent to a password. Do not disclose it. If accidentally lost, you can regenerate it in the credentials list at any time.

Step 7: Next Steps

Return to the RootAuth console. In Authentication Management → Providers → Google Configuration, fill in the Client ID and Client Secret obtained above, and ensure the redirect URI matches the one you entered in the Google Cloud Console.

Tip: If you haven't completed the configuration in RootAuth yet, you can leave it blank for now and edit the client later. However, it is recommended to have it ready in advance.

3. Configuring Google Login

3.1 Enabling Google Login

Find Google in the providers list and click the "Enable" button on the right. A configuration popup will appear. There is a toggle switch in the upper-left corner of the popup, which is off by default. Click to turn it "On"; the credential type options below will become selectable.

3.2 Selecting a Credential Type

The popup provides two credential types; you need to choose one:

Shared RootAuth Credentials
- Description: Test Google OAuth without any setup.
- Applicable Scenario: Development testing, quick validation.
- Action: After selecting this card, simply click the "Save" button in the lower-right corner of the popup for it to take effect.

Custom Credentials
- Description: Configure your own Google OAuth for production environments.
- Applicable Scenario: Official launch; requires you to apply for Google OAuth credentials yourself.
- Action: After selecting this card, a detailed configuration form will expand below. Complete the form before saving.

Custom Credentials Form Field Descriptions

Field	Description	Required
Google Client ID	The Client ID you generated in the Google Cloud Console	Yes
Google Client Secret	The corresponding Client Secret; input is masked	Yes
Authorized Redirect URI	Automatically generated by the system. You need to copy this URI and fill it in as a callback address in the Google Cloud Console	Read-only
Authorization Scope	Fixed as `email, profile, openid`; no modification needed	Read-only
Login Mode	Fixed as "Available for login/registration", meaning users can log in or register via Google	Checked by default, cannot be modified
Account Linking	If the email used for Google login matches an existing account email in the system, it is automatically linked; otherwise, a new account is created	Checked by default, cannot be modified

Note: When filling in the Client ID and Secret, the system does not validate their format or validity. Actual verification occurs during the OAuth flow when a user logs in with Google for the first time.

3.3 Saving the Configuration

After making your selection or filling in the form, click the "Save" button in the lower-right corner of the popup. Upon successful saving, the popup closes, and the status for Google in the providers list changes to "Enabled". If you selected Custom Credentials, it will be tagged as "Custom Credentials", and the button on the right will change to "Manage".

4. Managing an Enabled Configuration

Click the "Manage" button next to Google to reopen the configuration popup.

The popup will fully load the configuration state you last saved (toggle state, selected credential type, and any custom information entered).

You can modify the configuration within the popup (e.g., switch credential types, update custom credential fields). After making changes, click "Save" for them to take effect.

To disable Google login, turn off the toggle switch at the top of the popup and click "Save". Once disabled, the Google button will no longer be displayed on the end-user login page.

Note: After disabling Google login, any previously entered custom credential information is retained, so you won't need to re-enter it if you enable it again later.

5. End-User Experience

Once the configuration takes effect, a Google login button will automatically appear on your application's login and registration pages. You can preview the effect via Application – Application Management – Try Registration/Login in the upper-right corner. When users click this button, they will be redirected to the Google authorization page; after consenting, they can quickly log in or register.

If the email used for Google login already exists in your application's user pool, the system will automatically link the accounts.
Otherwise, a new user account will be created automatically.

Note on Caching: Due to possible browser or CDN caching, it may take up to 2 minutes for configuration changes to be fully effective for all end-users. If a user clicks the old button and encounters a prompt, refreshing the page should load the latest configuration.

6. Viewing a User's Linked Google Account

In the User Management → User Details page of your application, within the "Authentication Methods" section, you can view information about the user's linked Google account:

Google icon and name
Linked Google email address
Time of the last login using Google

Currently, this information is for display purposes only; manual unlinking is not supported.