## What Google needs from you

An OAuth 2.0 Web application client, with the redirect URI set to
`https://yourdomain.com/auth/google_oauth2/callback` exactly. Google matches it literally, so a
trailing slash or `http` instead of `https` is a rejection with a message that does not explain
itself.

Add `http://localhost:3000/auth/google_oauth2/callback` as a second authorized URI so development
works too. Google allows multiple.

## What the app already has

```bash
bin/rails routes | grep auth
```

The callback route is declared in `config/routes.rb` and handled by a controller that hands off to
`User.upsert_by_email!`. That method is the single signup chokepoint: first sign-in creates both the
`User` and the `Account` in one transaction, whether the person arrived by magic code or by Google.

Which means adding Google does not add a second signup path. Someone who signed up by email and
later clicks the Google button on the same address lands in the same account.

## The two settings that are easy to miss

**The consent screen.** An unpublished app in testing mode only admits the test users you list.
Everyone else gets an access-denied screen that looks like a code bug and is not.

**The content security policy.** Google's host must be in `form-action` in
`config/initializers/content_security_policy.rb`, and the sign-in form needs `data-turbo="false"`.
Miss either and the button silently does nothing.

## Verify

```bash
bin/dev
```

Click the button, complete consent, and check you land signed in. Then sign out and repeat with the
same address via a magic code: you should arrive in the same account, not a second one.

## In the native mobile shells

Social sign-in has to leave the web view. Google blocks OAuth inside embedded web views, so the
native apps open a system browser for it. See
[Auth in the App](/docs/mobile-apps/auth-in-the-app).