How do I add sign in with Google to a Rails app?

What Google needs from you

An OAuth 2.0 Web application client, with the redirect URI set to https://yourdomain.com/auth/google_oauth2/callback exactly. Google matches it literally, so a trailing slash or http instead of https is a rejection with a message that does not explain itself.

Add http://localhost:3000/auth/google_oauth2/callback as a second authorized URI so development works too. Google allows multiple.

What the app already has

bin/rails routes | grep auth

The callback route is declared in config/routes.rb and handled by a controller that hands off to User.upsert_by_email!. That method is the single signup chokepoint: first sign-in creates both the User and the Account in one transaction, whether the person arrived by magic code or by Google.

Which means adding Google does not add a second signup path. Someone who signed up by email and later clicks the Google button on the same address lands in the same account.

The two settings that are easy to miss

The consent screen. An unpublished app in testing mode only admits the test users you list. Everyone else gets an access-denied screen that looks like a code bug and is not.

The content security policy. Google's host must be in form-action in config/initializers/content_security_policy.rb, and the sign-in form needs data-turbo="false". Miss either and the button silently does nothing.

Verify

bin/dev

Click the button, complete consent, and check you land signed in. Then sign out and repeat with the same address via a magic code: you should arrive in the same account, not a second one.

In the native mobile shells

Social sign-in has to leave the web view. Google blocks OAuth inside embedded web views, so the native apps open a system browser for it. See Auth in the App.