Google sign-in

To enable Google sign-in, create OAuth clients for the platforms you support and configure the Google provider in Supabase.

Prerequisites

A Google Cloud project
The app setup completed, with your bundle identifier and Android package name set in config.js

The values you need

Client type	Used for	Goes in
Web	Requesting an ID token for Supabase	`config.js` → `googleOauth.webClientId`, and Supabase’s Google client IDs
iOS	Identifying your iOS app	`googleOauth.iosClientId` and its reversed value in `iosUrlScheme`; also add the client ID in Supabase
Android	Registering the package name and signing certificate	Google Cloud; no Android client ID field is needed in `config.js`

The native SDK obtains an ID token, which useSignInWithGoogle passes to supabase.auth.signInWithIdToken. The web client ID is needed even though the boilerplate uses native sign-in.

Create your OAuth clients

Configure your project’s audience and consent details in Google Cloud, then create a web client and the native clients you need. Follow the SDK’s configuration guide .

Selecting or creating a project in Google Cloud Console

Creating an iOS OAuth client ID in Google Cloud Console

For Android, register the SHA-1 fingerprint of the certificate that signs the installed build. Local debug builds, EAS builds and Google Play App Signing can use different certificates. Add an Android OAuth client for each package and certificate combination you use.

For a local debug keystore:


keytool -list -v -keystore ./android/app/debug.keystore \
  -alias androiddebugkey -storepass android -keypass android

Use eas credentials for EAS-managed keys. For a Play Store build, use the app signing certificate shown in Play Console.

Set the app’s client IDs

config.js


googleOauth: {
  iosClientId: '<ios-client-id>.apps.googleusercontent.com',
  iosUrlScheme: 'com.googleusercontent.apps.<ios-client-id>',
  webClientId: '<web-client-id>.apps.googleusercontent.com',
},

iosUrlScheme is the reversed iOS client ID. For example, 123-abc.apps.googleusercontent.com becomes com.googleusercontent.apps.123-abc. The config plugin reads this value when building the native app.

Configure Supabase

Enable the Google provider and register your client IDs, including the web client ID used in config.js and your native client IDs. When entering several IDs, use a comma-separated list with the web client ID first. See Supabase’s Google sign-in guide .

Enable Skip nonce check for the shipped native flow, which does not pass a custom nonce to signInWithIdToken. A Google OAuth client secret is for the browser redirect flow; the native ID-token exchange does not use it.

Enabling the Google provider in Supabase's Auth providers settings

Rebuild

Create a new development build after changing the native OAuth configuration. Reloading JavaScript alone does not update the iOS URL scheme.

Verify

Tap the Google button on each platform you support. The account picker should return to the app signed in, and the user should appear in Supabase Authentication → Users with a Google identity.

If Android sign-in fails before reaching Supabase, check the package name and signing fingerprint. If Supabase rejects the token, check its registered client IDs and nonce setting.

The Google Sign-In library already declares its Android dependencies. You do not need to add play-services-auth to the generated android/app/build.gradle.