Google auth

Google sign-in lets users authenticate with their Google account instead of creating a password.

Generated apps use industry-standard OAuth 2.0 through RIB Cloud runtime auth.

Setup options

RIB Cloud supports two setup modes:

• Managed by Rib: default and recommended. Rib manages the OAuth client, redirect handling, credentials, and security updates.
• Your own credentials: connect a Google Cloud OAuth Client ID and Client secret that you manage.

Both modes show users the same sign-in flow: click Sign in with Google, approve Google's consent screen, and return to your app signed in.

Managed by Rib

Use this when you want the simplest setup and do not need ownership of OAuth credentials or custom scopes.

Go to Cloud -> Users -> Google, turn on Google sign-in, keep Managed by Rib selected, and save.

Ask the agent:

Add Google login to my app so users can sign in with their Google account.

RIB enables Google auth, configures the runtime backend, adds or updates sign-in UI, manages auth state, and adds sign-out support.

Your own credentials

Use this when you need your own Google Cloud project, consent-screen branding, credential control, or stricter compliance ownership.

In Google Cloud Console:

• Configure an OAuth consent screen.
• Create an OAuth Client ID of type Web application.
• Add every redirect URI you intend to use, exactly as shown in RIB.

Then go to Cloud -> Users -> Google, select Your own credentials, enter the Client ID and Client secret, select the redirect URIs you authorized, and save.

RIB shows suggested redirect URIs for your published Rib domain and active custom domains. Add each URI you plan to use in Google Cloud exactly as shown. The Client secret is only used when saving and is never displayed again.

Ask the agent:

Add Google sign-in to my app using my own Google OAuth credentials.

When to use auth planning

Plan auth before building when:

• The app has user accounts.
• Pages need protected access.
• Data should belong to a signed-in user.
• You need login, signup, sessions, or account settings.
• The project may later need enterprise identity or SSO.

Auth safety checklist

• Do not store credentials in prompts.
• Do not fake sessions for production-bound apps.
• Do not rely on localStorage as real auth.
• Confirm Google auth is enabled in Cloud -> Users -> Google.
• For BYOK, redirect URIs must match Google Cloud exactly.
• Test signed-in, signed-out, and loading states.
• Review any user data collection carefully.

Testing

After setup, verify:

• A Sign in with Google button appears.
• Users are redirected to Google.
• Users return signed in.
• Users can sign out.
• The Google consent screen shows the expected app details.

Switching between Managed by Rib and Your own credentials does not remove existing users.