How to create an OAuth client ID for Sign in with Google in Google Cloud
Set up the Google Auth Platform branding (the consent screen) first, then open Clients, click Create client, choose Web application, add your authorised JavaScript origin and redirect URI and click Create. Copy the Client ID and Client secret from the dialog that follows.
This is for a developer adding Sign in with Google to a web app, often because a coding agent wrote the code and now needs a client ID and secret it cannot create itself. Google will not let you create a client until the consent screen (now called Branding in Google Auth Platform) exists, so that comes first. Then you create a Web application client with your exact origin and callback URL.
Before you start
You need a Google account with Owner or Editor on a Google Cloud project, or permission to create one. Know your app's callback URL, for example https://example.com/auth/google/callback.
- Time
- About 5 minutes
- Account
- Not walked yet
| Role | What it can do here |
|---|---|
| Owner or Editor | Can configure the Google Auth Platform and create OAuth clients in the project. |
| Viewer | Can see the clients list but not create a client or read its secret. |
-
1
Pick or create a project
Open the Google Cloud console and choose your project in the project picker at the top. Click New project if you want a separate one for this app.
You should see: Your project's name in the picker at the top of the console.
-
2
Open Google Auth Platform
In the left menu or the search bar, open Google Auth Platform. If it has never been set up, click Get started.
You should see: A setup form asking for App information, Audience and Contact information.
-
3
Fill in the branding
Enter an App name and a User support email, choose External as the audience unless everyone who signs in is in your Google Workspace, add a developer contact email, agree to the policy and click Create.
You should see: The Google Auth Platform overview, with Branding, Audience, Clients and Data access in the left menu.
-
4
Open Clients
Click Clients in the left menu, then click Create client.
You should see: A form with an Application type list.
-
5
Choose Web application
Set Application type to Web application and give the client a name you will recognise, such as the app and environment.
You should see: Two new sections, Authorised JavaScript origins and Authorised redirect URIs.
-
6
Add the origin and redirect URI
Under Authorised JavaScript origins click Add URI and enter your site, such as https://example.com. Under Authorised redirect URIs click Add URI and enter your full callback URL, such as https://example.com/auth/google/callback.
You should see: Each URI in its own field, with no error under it.
-
7
Click Create
Click Create at the bottom of the form.
You should see: A dialog called OAuth client created with the Client ID and Client secret, and a Download JSON option.
-
8
Copy the ID and secret
Copy the Client ID and the Client secret into your app's credentials or secret store, or click Download JSON. Do not paste the secret into chat or commit it.
You should see: The new client listed under Clients with its creation date.
If it does not work
Create client sends you to a consent screen or branding form instead. Finish the Google Auth Platform setup (App name, support email, audience, contact email) and click Create. Then go back to Clients.
Sign in fails with Error 400: redirect_uri_mismatch. The callback URL your app sends is not listed exactly under Authorised redirect URIs. Copy the redirect_uri from the error details and add it character for character, including http or https, the port and any trailing slash.
Users see Access blocked: this app's request is invalid, or only test users can sign in. The app is still in Testing on the Audience page. Add the people as test users, or publish the app to In production.
The Authorised JavaScript origins field rejects your value. An origin has no path and no trailing slash. Use https://example.com, not https://example.com/ or https://example.com/login.
Questions
Why does Google ask me to configure the consent screen before I can create a client?
A client has to belong to an app with a name, a support email and an audience. That is the Branding and Audience setup in Google Auth Platform. Until it exists, Create client sends you there first.
Which application type do I choose for Sign in with Google on a website?
Web application. Desktop app and the mobile types have no redirect URI field and will not work with a server side callback.
What is the difference between an authorised JavaScript origin and an authorised redirect URI?
The origin is the scheme, host and port your page runs on, such as https://example.com, with no path. The redirect URI is the full callback URL Google sends the user back to, path included. Most server side libraries need the redirect URI; the Google Identity Services button needs the origin.
Can I see the client secret again later?
Google has been moving to showing the secret only once, in the dialog after Create. Download the JSON or copy it then. If you lose it, add a new secret on the client and delete the old one.
Do I need separate clients for localhost and production?
No. One client can list several origins and redirect URIs, so http://localhost:3000 and https://example.com can sit on the same client. Many teams still keep a separate project for development.
How we checked
Verified 11 Oct 2026 against the live interface on not walked yet.
Related guides
Ready to do it?
Run these 8 steps on your own Google Cloud page. Each step shows in a panel on the page, Next when you are ready.