Sign in with Google
Let users sign in with their Google account while your app only ever consumes Hawcx-issued tokens — Hawcx brokers the login and re-issues its own identity.
Social Connect lets users sign in with Sign in with Google while your application continues to consume only Hawcx-issued tokens. Hawcx sits in the middle as an identity broker: it is an OpenID Provider (OP) to your app and an OAuth client to Google.
Hawcx never passes Google's token through
Your app never receives Google's ID token or access token. Hawcx verifies Google's response,
resolves it to a Hawcx user, and re-issues its own ID token. Nothing about your token
verification changes — you keep validating a Hawcx-signed token with a Hawcx iss and your
client_id as aud, exactly as with any other Hawcx sign-in.
How brokering works
The federation with Google is entirely server-side and invisible to your app. Whether a user signs in passwordless with their device or with Google, your relying party runs the same Authorization Code + PKCE flow and verifies the same Hawcx-signed ID token. See OIDC integration for that flow.
What you get
- One stable identity. The
subclaim in the Hawcx ID token is a stable Hawcxuser_id, not Google's subject. It does not change if the user later adds another sign-in method, and it is the same value your app already keys users on. - Passwordless bootstrap. A first-time Google sign-in provisions a Hawcx user (JIT provisioning). From there the user can enroll a device and continue passwordless — Google becomes an optional convenience, not a hard dependency.
- No Google token handling. You never store, verify, or refresh a Google token. Provider secrets live in Hawcx; your app's trust boundary stays with the Hawcx JWKS.
Not an authorization to Google APIs
Social Connect authenticates users. It does not grant your app access to Google APIs (Gmail, Drive, Calendar) — Hawcx requests only identity scopes and retains no Google tokens. See what's not covered.
Get started
Quickstart
Enable the provider in the Admin Console and add the button.
Google Cloud setup
Create the OAuth client, redirect URI, JS origins, and pass consent-screen verification.
Account linking
Verified-email linking, the takeover guard, and JIT provisioning.
Custom OIDC providers
Point a connection at any OIDC-compliant IdP — issuer_allowlist, claims_mapping, and the account-linking risk for untrusted providers.
Reference
Normalized claims, federated identities, and redirect vs One Tap.