Setting Up Google OAuth

Setting Up Google OAuth

The web interface uses Google OAuth 2.0 for authentication. This guide walks through creating the credentials.

1. Create a Google Cloud Project

1. Go to Google Cloud Console.
2. Click Select a project → New Project.
3. Name it (e.g., "Urn Randomizer") and click Create.

2. Configure the OAuth Consent Screen

1. Navigate to APIs & Services → OAuth consent screen.
2. Select Internal (if using Google Workspace) or External.
3. Fill in:
   • App name: Urn Randomizer
   • User support email: your email
   • Authorized domains: your deployment domain (e.g., onrender.com)
   • Developer contact: your email
4. Click Save and Continue.
5. Under Scopes, add:
   • email
   • profile
6. Click Save and Continue through the remaining steps.

3. Create OAuth Credentials

1. Navigate to APIs & Services → Credentials.
2. Click Create Credentials → OAuth client ID.
3. Select Web application.
4. Set:
   • Name: Urn Randomizer
   • Authorized redirect URIs:
     • For local development: http://localhost:5000/login/google/authorized
     • For production: https://your-domain.com/login/google/authorized
5. Click Create.
6. Copy the Client ID and Client Secret.

4. Configure the Application

Add the credentials to your .env file:

GOOGLE_OAUTH_CLIENT_ID=your-client-id.apps.googleusercontent.com
GOOGLE_OAUTH_CLIENT_SECRET=your-client-secret
FLASK_SECRET_KEY=a-random-secret-key-for-sessions

Or set them as environment variables in your deployment platform (Render, Heroku, etc.).

5. Register Users

OAuth alone doesn't grant access — users must be pre-registered:

flask add_user alice alice@gmail.com

The email must match the Google account the user will log in with. When a user signs in with Google for the first time, the system matches their Google email to the registered user record.

Common Issues

"Access blocked: This app's request is invalid"

• Check that the redirect URI exactly matches what's configured in Google Cloud Console.
• The path must be /login/google/authorized (not /login/google/callback).

"Error 403: access_denied"

• For External apps, you may need to add test users in the OAuth consent screen while in testing mode.
• Or publish the app (requires Google verification for sensitive scopes).

OAuth works locally but not in production

• Make sure you added the production redirect URI to the Google Cloud Console.
• Ensure HTTPS is enabled — Google requires HTTPS for redirect URIs in production.
• Check that FLASK_SECRET_KEY is set — without it, sessions won't persist.

"User not found" after successful Google login

• The user's Google email must match a registered user. Run:

  flask list_users

  to verify, then add missing users with flask add_user.

Bypassing OAuth for Development

Set DEMO_MODE=true to skip OAuth entirely:

export DEMO_MODE=true
flask run

This auto-logs in all visitors as a demo user. Never use this in production with real data.