mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
24 lines
1.3 KiB
Plaintext
24 lines
1.3 KiB
Plaintext
The good news — no Google verification required for the scopes we use (openid email profile). Verification is only mandatory for sensitive scopes
|
|
like Gmail or Drive access. Basic OIDC login is exempt.
|
|
|
|
What you DO need for production:
|
|
|
|
1. Publish the app (remove testing restriction)
|
|
- Google Auth Platform → Audience → change from Testing to Production
|
|
- Right now only manually added test users can log in — publishing removes that limit
|
|
|
|
2. Add production URIs to the OAuth client
|
|
- Authorized JavaScript origins: add https://yourdomain.com and https://api.yourdomain.com
|
|
- Authorized redirect URIs: add https://api.yourdomain.com/api/auth/google/callback
|
|
|
|
3. Update production .env
|
|
GOOGLE_CALLBACK_URL=https://api.yourdomain.com/api/auth/google/callback
|
|
FRONTEND_URL=https://yourdomain.com
|
|
|
|
4. HTTPS is required — Google won't allow http:// redirect URIs in production (localhost is the only exception). Your production server needs SSL,
|
|
which you likely already have via Nginx.
|
|
|
|
5. Add Privacy Policy URL to the branding page — Google requires it when the app is published (even without verification). A simple /privacy page on
|
|
your frontend is enough.
|
|
|
|
That's the full checklist. The localhost dev setup stays untouched alongside the production URIs — Google allows multiple redirect URIs per client. |