Setting up Google

There is a guided version of this page at /setup/google, which fills in your deployment's real callback URL and checks the credentials once they're set. This is the same walkthrough in text.

1. Create the OAuth client

In the Google Cloud Console, go to APIs & Services → Credentials → Create Credentials → OAuth client ID, and choose Web application as the type.

2. Add the redirect URI

Under Authorized redirect URIs, add:

https://<deployment>.convex.site/api/auth/callback/google

<deployment> is your Convex deployment name — convex dev prints it, and it's the hostname in VITE_CONVEX_SITE_URL.

Note this is the .convex.site deployment, not your app's domain. Unlike Apple, Google doesn't verify the domain, so the callback can go straight to the deployment and never touch your site. Getting this wrong is what produces redirect_uri_mismatch.

3. Set the credentials

bunx convex env set GOOGLE_CLIENT_ID "<client id>"
bunx convex env set GOOGLE_CLIENT_SECRET "<client secret>"

Both must be present for the provider to register at all — convex/auth.ts checks the pair, so setting one leaves Google switched off.

4. Check it

Reload the sign-in card. The Google button loses its "needs setup" badge once the deployment can see both variables — that badge is driven by a live probe against the server, not by anything cached in the page.

Questions

Why does the redirect URI point at .convex.site and not my domain? Because Google doesn't verify domains for the callback, so there's no reason to proxy it. Apple does, which is why Apple's callback is the one path that goes through your own domain.

I get redirect_uri_mismatch. The URI in the Cloud Console must match the callback exactly, including the scheme, the host and the whole /api/auth/callback/google path. A trailing slash counts as a mismatch.

Can one client id serve several apps? Yes. Every app that embeds AussieAuth talks to the same deployment, so they share this one OAuth client.

Does the user see a consent screen for my app as well as for Google? No. Google's is the only one. The app talks to the deployment from its own origin, so there's no AussieAuth-hosted page to approve.