Google login

Phase 1 preview — pages render fixture data only; no changes are saved.
Google login is disabled. Nothing below is used until it is enabled.
Saved credentials still work while this is off. Legacy serves the Google sign-in route whenever a client ID and secret are saved, even with the switch off. A rebuilt backend should honour the switch.

Google OAuth client

Adds a Google button to the sign-in page when both credentials are saved.
Must end with apps.googleusercontent.com. The client ID is not a secret.
Configured
Write-only. The stored secret is never shown; enter a new one to replace it.
Cancel Saving settings is not available in Phase 1 — this screen previews the current configuration.

Authorised redirect URI

Add this redirect URI to the OAuth client in the Google Cloud console.

Callback URL
https://assets.example.test/google/callback

How sign-in behaves

A person is matched by exact username equal to their Google email address. Deactivated users are refused.

There is no allowed-domain or hosted-domain setting, no email-verified check and no auto-provisioning: nobody is created. Google sign-in always remembers the user.

Legacy has no test button for this screen.