Let people into your Softr app with their Google account — create an OAuth client in Google Cloud, then paste the credentials into your app’s authentication settings.
Google Sign-in puts a Continue with Google button on your app’s sign-in and sign-up forms. People who already have a Google account get in with one click, and you never hold a password for them.Setting it up happens in two places: you create an OAuth client in the Google Cloud console, then paste its client ID and secret into Softr. Keep both tabs open — you will be moving between them.
Google Sign-in is one of the methods on the sign-in form, alongside email and password. It is not the same as SSO, which hands authentication to your own identity provider over SAML or OpenID. You can switch both on at once.
Creating a project needs the resourcemanager.projects.create permission. Personal Google accounts have it; a work account in a Google Cloud organization often does not, and the No organization row in the project picker will be marked with a warning triangle. If that happens, ask whoever administers your Google Cloud organization to create the project — or to grant you the permission — and carry on from step 2.
Your app's URL, exactly as visitors see it
Open your published app and copy the address out of the browser bar. On a Softr subdomain that is https://yourapp.softr.app, with no www.; on a custom domain it is whatever host you connected. You need the scheme and host only — no trailing slash, no path.
In the Google Cloud console, give the project a name. Google derives a project ID from it, which cannot be changed later. If your account belongs to an organization you also have to pick a Parent resource. Click Create.
Naming a new project in the Google Cloud console.
Already have a project for this app? Skip this step and pick it from the project picker in the console’s top bar instead.
2
Name the app people will consent to
Go to Google Auth Platform → Branding. App name and User support email are what people see on Google’s consent screen the first time they sign in, so use the name of your portal rather than the project ID. Click Save.
App name and support email on the Branding page.
On a brand-new project, opening Google Auth Platform starts a short Get started wizard that asks for the app name, support email, audience and a contact address in one pass. Complete it and you arrive at these pages with the work already done. Google documents the rest of the branding options in Manage OAuth App Branding.
3
Choose who can sign in — and publish the app
Open Audience. Two settings on this page decide who gets in.
Publishing status and user type on the Audience page.
Publishing status. A new project starts in Testing, and while it is in Testing only the Google accounts listed under Test users can sign in — up to 100 of them. Click Publish app to move it into production.
User type.External lets anyone with a Google account sign in. Internal appears only if your Google account belongs to a Google Workspace organization, and limits sign-in to that organization.
Leaving the project in Testing is the most common reason a correctly configured Google Sign-in still fails: everyone who is not on the test-user list is refused. Publish the app before you point real users at it. Google’s Manage App Audience covers the limits in full.
Note which User type you picked. You set the same value on the Softr side.
4
Create the OAuth client
Go to Clients → Create client. Set Application type to Web application and give the client a name. The name is only used to identify the client in the console; nobody signing in ever sees it.
Choosing the Web application client type.
5
Add your app's URL to both lists
Under Authorized JavaScript origins, click Add URI and paste your app’s URL. Then do the same under Authorized redirect URIs. Click Create.
The same app URL added as a JavaScript origin and a redirect URI.
Match the origin your visitors actually load, character for character. A Softr subdomain has no www. — https://acme-portal.softr.app, not https://www.acme-portal.softr.app, which does not resolve. On a custom domain, include www. only if that is the host people land on.
Google registers the domains of these URIs as Authorized domains on your consent screen automatically, so there is no separate step for that. Changes to a client can take anywhere from five minutes to a few hours to take effect.
6
Copy the client ID and secret
Google shows the new client’s ID and secret as soon as it is created. Copy both before you close the panel.
Google no longer lets you view a client secret after creation — the client’s page shows only its last four characters. If you lose it, open the client and use Add secret to issue a new one, then update Softr with the new value.
In Softr Studio, open your app and go to Users → Authentication. Turn on the Google Sign-in toggle (1), then click the gear (2) to open its settings.
The Google Sign-in row in the Authentication method list.
An amber dot next to a method means Setup is incomplete — it is switched on but has no working configuration yet. It clears once you save valid credentials.
2
Paste the credentials
Paste the Google client ID and Google client secret you copied from the console (1). Then set User type (2) to the same value you chose on the Audience page.
The Google Sign-in settings dialog with Internal selected.
With Internal, a Google Sign-in email domains field appears. Anyone whose email address is on one of these domains is always sent to Google to log in, even when your app also offers email or SSO. Choosing External hides the field, because an external client accepts any Google account.
With External selected, the email domains field is not shown.
3
Save and publish
Click Save, then publish your app so the change reaches the live site. The amber dot beside Google Sign-in should disappear.
Continue with Google appears above the email field on both the sign-in and the sign-up form. The first time someone uses it, Google shows a consent screen carrying the app name and support email you set under Branding.
The Continue with Google button on a published app's login page.
Signing in this way creates or matches a record in your app’s users list on the email address the Google account carries.
Google refuses the request before showing the account chooser
The URL registered on the OAuth client does not match the address the browser is on. Compare them character for character: http against https, www. present or absent, and no trailing slash. If you have just changed the client, give it a few minutes — Google warns that client changes can take up to a few hours to propagate.
Some people can sign in and others cannot
Either the Google Cloud project is still in Testing, in which case only the accounts on the test-user list are allowed, or the client’s User type is Internal and the people being refused are outside your Google Workspace organization. Both live on the Audience page.
The amber dot beside Google Sign-in will not clear
Softr marks a method Setup is incomplete until it has a client ID and secret saved. Reopen the gear and check both fields are filled and saved.
Only people on certain domains are sent to Google
That is the Google Sign-in email domains field doing its job. Clear it if you want those people to be able to use email or SSO as well.
