Add Google sign-in to an Auth.js application
User authentication
Auth.js · Function
Google is a built-in Auth.js OAuth provider. Add it to the framework configuration, provide Google OAuth credentials, and register the provider-specific callback URL.
How it works
The built-in Google provider supplies the OAuth/OIDC configuration used by Auth.js. Add it to the framework adapter's providers list, configure the matching credentials through environment variables, and register the generated callback URL in Google Cloud; customize authorization parameters when offline refresh tokens are needed.
Syntax
Google(options?)Parameters
| Name | Type | Description |
|---|---|---|
options | GoogleConfig | Google provider options, including optional OAuth client credentials and authorization settings. |
Returns
A configured Auth.js Google provider object for use in the providers array.
Key points
- Auth.js provides Google as a built-in provider rather than requiring a custom OAuth provider definition.
- The standard environment variables for Google's client ID and client secret are
AUTH_GOOGLE_IDandAUTH_GOOGLE_SECRET. - The provider uses Google's OpenID Connect behavior as its default configuration.
- The normalized Google profile includes an
email_verifiedboolean that can inform account or email handling. - Pass provider options when the default Google authorization settings do not meet the application's requirements.
Common mistakes
- A refresh token may not be returned on subsequent authorizations; request offline access and handle Google's first-consent behavior when long-lived access is required.
- The Google Cloud redirect URI must use the complete application origin and the provider callback path; a mismatched URI prevents the OAuth flow from completing.
Example: Configure Google sign-in
import NextAuth from "next-auth"
import Google from "next-auth/providers/google"
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [Google],
})Register the built-in Google provider in a Next.js Auth.js configuration. Define AUTH_GOOGLE_ID and AUTH_GOOGLE_SECRET in the environment before starting the application.
When to use it
Load Google OAuth credentials from standard environment variables
Credential management
Request offline authorization when the application needs refresh tokens
Token access
Interview questions
QHow do you add Google authentication to a Next.js Auth.js configuration?
Import the provider from the framework-specific providers package and include it in the Auth.js providers array. With automatic environment-variable discovery, the expected names are AUTH_GOOGLE_ID and AUTH_GOOGLE_SECRET.
Follow-up: How would you configure explicit credentials? Pass clientId and clientSecret to Google({...}) instead of using the shorthand provider value.
QWhat callback URL must Google OAuth use?
For Next.js, the callback is /api/auth/callback/google, so a production deployment uses https://<your-domain>/api/auth/callback/google. That exact URI must be registered as an authorized redirect URI in Google Cloud.
Follow-up: What changes for Express? The default callback is /auth/callback/google, unless the Auth.js handler is mounted at a different path.
QHow do you request a Google refresh token?
Google follows an OpenID Connect-based default configuration and returns an email_verified boolean in the OAuth profile. If the application needs a refresh token, configure authorization parameters such as access_type: "offline", response_type: "code", and commonly prompt: "consent".
Follow-up: Why might offline access still fail to produce a refresh token? Google generally supplies one only on the first user authorization, so the consent state and prior grants matter.
Related
OAuth ProvidersCustomizing a built-in OAuth providerEnvironment VariablesAuthConfig.providers