Magic codes work with zero configuration. Google and Apple sign-in are additive options on top of
that, and each sign-in button only renders once its credentials are actually configured, so an
unconfigured provider simply doesn't appear rather than showing a broken button.

## Google sign-in

Set `google.client_id` and `google.client_secret` in Rails encrypted credentials, or wire the
equivalent environment variables in `config/initializers/omniauth.rb` if you'd rather not store
them in credentials. The authorized redirect URI to register in Google's console is
`https://yourdomain.com/auth/google_oauth2/callback`.

## Apple sign-in

Apple sign-in needs an Apple Developer Program account ($99/year), the same one you'd need for App
Store distribution if you ship the iOS app; see [Mobile Overview](/docs/mobile-apps/mobile-overview).
It's enabled in the app by default and its button renders once configured. In credentials, set
`apple.client_id` (your Services ID), `apple.team_id`, `apple.key_id`, and `apple.private_key` (the
contents of the `.p8` key file Apple gives you). Apple requires a Services ID and domain
verification even for web-only sign-in, not just for the native app.

## In the native mobile shells

Neither provider can complete its OAuth flow inside an embedded web view; Google actively blocks
it. Both shells open social sign-in externally instead, and Sign in with Apple specifically is
hidden on the Android shell entirely, since Apple only requires it on iOS. See
[Auth in the App](/docs/mobile-apps/auth-in-the-app) for the full mechanics.

## Next

See what's optional beyond authentication and billing:
[Optional Integrations](/docs/bring-your-own-keys/optional-integrations).