Start shipping →

Docs · Bring Your Own Keys

Sign in with Google and Apple

OAuth credentials for both providers.

Magic codes work with zero configuration. Google and Apple sign-in are additive options on top of that, and each sign-in button only renders once its credentials are actually configured, so an unconfigured provider simply doesn't appear rather than showing a broken button.

Google sign-in

Set google.client_id and google.client_secret in Rails encrypted credentials, or wire the equivalent environment variables in config/initializers/omniauth.rb if you'd rather not store them in credentials. The authorized redirect URI to register in Google's console is https://yourdomain.com/auth/google_oauth2/callback.

Apple sign-in

Apple sign-in needs an Apple Developer Program account ($99/year), the same one you'd need for App Store distribution if you ship the iOS app; see Mobile Overview. It's enabled in the app by default and its button renders once configured. In credentials, set apple.client_id (your Services ID), apple.team_id, apple.key_id, and apple.private_key (the contents of the .p8 key file Apple gives you). Apple requires a Services ID and domain verification even for web-only sign-in, not just for the native app.

In the native mobile shells

Neither provider can complete its OAuth flow inside an embedded web view; Google actively blocks it. Both shells open social sign-in externally instead, and Sign in with Apple specifically is hidden on the Android shell entirely, since Apple only requires it on iOS. See Auth in the App for the full mechanics.

Next

See what's optional beyond authentication and billing: Optional Integrations.

Common questions

How do I add sign in with Google to a Rails app?

Create an OAuth 2.0 client in Google Cloud Console, add your callback URL as an authorized redirect URI, and set the client id and secret. One Shot already has the OmniAuth callback route and the user upsert, so no code changes. Google's host also has to be in the content security policy's form-action list.

Why does my OAuth sign-in button do nothing when clicked?

The content security policy is blocking the navigation. form-action covers the whole redirect chain a form starts, so the provider's host must be listed in config/initializers/content_security_policy.rb. The form also needs data-turbo="false", or Turbo submits it by fetch and the cross-origin redirect is blocked as an XHR instead.

Why does sign in with Apple need a paid developer account?

The client id and private key come from the Apple Developer Program, which is a paid membership at 99 dollars a year. There is no free tier for issuing Sign in with Apple credentials. Google's OAuth client is free, so if you only want one social provider to start, Google is the one with no standing cost.