Sign in with Google

Sign users in with Google through Abrova Auth. The app runs Google's native sign-in with a hashed nonce; Abrova verifies Google's ID token for your own OAuth client IDs.

Sign in with Google.

Your app runs Google's own sign-in (Credential Manager on Android, Google Sign-In on iOS and Flutter, Google Identity Services on the web) and receives an ID token. The SDK sends that token to Abrova Auth, which checks that Google issued it to one of your OAuth client IDs and signs the user in.

Users in Iran.

Google sign-in needs a connection to Google, and on Android also Google Play services. Some users in Iran have neither: phones sold without Google Play services, or Google services that cannot be reached. For them the Google button fails before Abrova Auth is asked. Anonymous, e-mail and password, magic link and Telegram code work without Google, so offer at least one of them next to the Google button.

Set it up in the Console#

In Google Cloud Console › APIs & Services › Credentials, find (or create) the OAuth client IDs your apps sign in with. Android, iOS and web each have their own.
In Abrova Console, open Abrova Auth › Sign-in methods, turn on Google, and add every client ID your apps use.

Abrova Auth accepts a Google ID token only when its audience is one of these client IDs.

Which client ID ends up in the token.

On Android with Credential Manager, and with google_sign_in when you pass a serverClientId, the ID token is issued to your web client ID. Add the web client ID to the list even if you have no web app.

The nonce#

Create a random raw nonce with the SDK's helper, give Google its lowercase hex SHA-256, and give Abrova Auth the raw value. Abrova checks that they match and accepts each nonce once. The ID token must be less than 10 minutes old.

SDK	Raw nonce	Value for Google
Flutter	AbrovaAuthNonce.generate()	AbrovaAuthNonce.sha256Hex(raw)
iOS	AbrovaNonce.generate()	AbrovaNonce.sha256(raw)
Android	AbrovaNonce.generate()	AbrovaNonce.sha256(raw)
Web, React Native	(await auth.createNonce()).rawNonce	(await auth.createNonce()).hashedNonce

The nonce is required.

Abrova Auth refuses a Google sign-in without a raw nonce (INVALID_INPUT), so every SDK requires it.

Android (Credential Manager)

Add androidx.credentials:credentials, androidx.credentials:credentials-play-services-auth and com.google.android.libraries.identity.googleid:googleid to your app:

kotlin

val rawNonce = AbrovaNonce.generate()
val option = GetGoogleIdOption.Builder()
    .setServerClientId(WEB_CLIENT_ID)
    .setFilterByAuthorizedAccounts(false)
    .setNonce(AbrovaNonce.sha256(rawNonce))
    .build()
val response = CredentialManager.create(context)
    .getCredential(context, GetCredentialRequest.Builder().addCredentialOption(option).build())
val idToken = GoogleIdTokenCredential.createFrom(response.credential.data).idToken

AbrovaAuth.shared.signInWithGoogle(idToken, rawNonce)

Flutter

With google_sign_in 7:

dart

final raw = AbrovaAuthNonce.generate();
await GoogleSignIn.instance.initialize(
  serverClientId: 'xxx.apps.googleusercontent.com',
  nonce: AbrovaAuthNonce.sha256Hex(raw),
);
final account = await GoogleSignIn.instance.authenticate();

await AbrovaAuth.instance.signInWithGoogle(
  idToken: account.authentication.idToken!,
  rawNonce: raw,
);

iOS

Request the Google ID token with AbrovaNonce.sha256(rawNonce) as its nonce, then:

swift

try await AbrovaAuth.shared.signInWithGoogle(idToken: idToken, rawNonce: rawNonce)

Web and React Native

Give hashedNonce to Google Identity Services (web) or your React Native Google sign-in library as the nonce:

typescript

const { rawNonce, hashedNonce } = await auth.createNonce();
// ... run Google's sign-in with nonce: hashedNonce, then:
await auth.signInWithGoogle({ idToken, rawNonce });

E-mail#

Abrova Auth uses the Google e-mail only when Google says it is verified, and stores it (encrypted) only when Store profile data is on under Abrova Auth › Settings. A Google account and an Apple or password account with the same e-mail stay separate users unless the user links them.

Link Google to a signed-in user#

To upgrade an anonymous user, call linkGoogle(...) with the same arguments. The user keeps their id. If this Google account already belongs to another user, the call fails with PROVIDER_ALREADY_LINKED.

Errors#

Code	Meaning
NOT_CONFIGURED	Google is on, but no client ID is entered.
INVALID_ID_TOKEN	Google did not sign it, it was issued to a client ID that is not in your list, it is older than 10 minutes, or its nonce is not the SHA-256 of the raw nonce you sent.
INVALID_INPUT	The raw nonce is missing or not 16 to 256 characters.
NONCE_REUSED	This nonce was already used. Create a new one for every sign-in.
PROVIDER_ALREADY_LINKED	Linking only: the Google account belongs to another user.
METHOD_DISABLED	Google sign-in is off for the project.

1Set it up in the Console#

2The nonce#

3Sign in#