Google Cloud Setup
Create a Google OAuth client, register the Hawcx redirect URI and JavaScript origins, and pass consent-screen verification.
Create the Google OAuth client that Hawcx uses to broker sign-in. You do this once per project in the Google Cloud Console. The resulting client ID and client secret go into the Hawcx Admin Console (quickstart).
Who holds the secret
The Google client secret is entered into Hawcx and stored encrypted. It is never shipped to your app or the browser — Hawcx is the OAuth client to Google, so the secret lives with the broker.
Configure the OAuth consent screen
In APIs & Services → OAuth consent screen, pick External user type (unless every user is in your Google Workspace org, in which case Internal skips verification). Fill in the app name, support email, and developer contact.
Request only identity scopes — Hawcx needs openid, email, and profile and nothing more.
Adding sensitive or restricted scopes triggers a heavier Google review and gains you nothing:
Social Connect authenticates users, it does not call Google APIs.
Create the OAuth client and set the redirect URI
In APIs & Services → Credentials → Create credentials → OAuth client ID, choose Web application. Under Authorized redirect URIs, add the Hawcx hosted-login callback exactly as shown in the Admin Console:
https://<your-hosted-login-host>/oidc/callbackThis points at Hawcx, not your app
Google redirects to Hawcx's /oidc/callback, where the broker verifies Google's response and then
redirects to your app's redirect_uri with a Hawcx code. Do not register your application's
callback here. Google requires an exact match, so copy the value from
Settings → Social Connect verbatim — no trailing slash, correct scheme and host.
Add Authorized JavaScript origins (One Tap)
If you use One Tap / token mode (Google renders its prompt directly on the hosted sign-in page and returns a credential in the browser), add the hosted-login origin under Authorized JavaScript origins:
https://<your-hosted-login-host>Plain redirect mode does not need JavaScript origins. One Tap does, because Google's client library runs in the page. See redirect vs One Tap.
Pass consent-screen verification
While your consent screen is in Testing, only the test users you explicitly list can complete sign-in — everyone else is blocked by Google with an "app not verified" error.
To let arbitrary users sign in with Google you must publish the app and, if Google requires it for your scopes or branding, complete verification:
| State | Who can sign in |
|---|---|
| Testing | Only listed test users (up to Google's cap). |
| In production, unverified | Users see an "unverified app" warning; may be rate-limited or blocked depending on scopes. |
| In production, verified | Any Google user, no warning. |
Plan verification ahead of launch
Google verification can take days. Do your development and staging testing with test users,
and submit for verification before you expose Google sign-in to real users in production. Identity
scopes (openid, email, profile) are the lightest review path.
Checklist
- Consent screen configured, identity scopes only (
openid,email,profile). - Authorized redirect URI =
https://<your-hosted-login-host>/oidc/callback(exact match). - Authorized JavaScript origin added if using One Tap.
- Client ID + secret entered in Hawcx Settings → Social Connect.
- Test users added for pre-launch, or app published and verified for production.
Next steps
- Quickstart: enter the credentials and toggle the button on.
- Account linking: map Google identities to Hawcx users safely.