Sign in with Google

How to register Curupira in the Google Cloud Console so your tenant's users can sign in with their Google account.

Console: console.cloud.google.com (pick or create a project first).

What you'll hand to Curupira at the end: a Client ID and a Client Secret. Everything else below is Google-side configuration so those credentials work.

Curupira detail	Value
Type	OpenID Connect (signed id_token, verified)
Callback URL to register	https://auth.curupira.api.br/sso/google/callback
Default scopes	openid email profile

1 · OAuth consent screen

APIs & Services → OAuth consent screen.

Field	What to put
User type	External (unless every user is in your Google Workspace org → Internal)
App name	Your app's name
User support email	Your support address
Authorized domain	curupira.api.br
Developer contact	Your email

Scopes: add openid, email, profile. These are non-sensitive — no Google verification/review required.

Publishing status: while in Testing you must list each user under Test users and are capped at 100 of them. For real use click Publish app and set the status to In production (non-sensitive scopes publish without review) so anyone with a Google account can sign in.

2 · Create the OAuth client ID

APIs & Services → Credentials → Create Credentials → OAuth client ID.

Field	What to put
Application type	Web application
Authorized redirect URIs	https://auth.curupira.api.br/sso/google/callback (paste exactly)

Google matches the redirect URI character-for-character — https, no trailing slash, lower-case. Create.

3 · Copy the credentials

The dialog shows the Client ID and Client secret — copy both (you can re-open them from the credential's detail page later).

4 · Add the connection in Curupira

In the admin dashboard → SSO Connections, choose your tenant and Add SSO Connection:

• Provider: Google
• Client ID / Client Secret: from step 3 (the secret is stored encrypted and never shown again)
• Scopes: leave blank to use the defaults (openid email profile)
• Enabled: on

Then test at https://auth.curupira.api.br/sso/google/authorize?tenant=<your-tenant-slug> — a Google consent screen should send you back to Curupira signed in.

:::note Account linking If Google returns an email that matches an existing password account, sign-in is refused — sign in with your password first, then connect SSO from your account settings. A brand-new email creates an SSO-only user automatically. :::

Checklist

• Consent screen: External, app name, authorized domain curupira.api.br
• Scopes openid email profile added (non-sensitive → no review)
• Test users added or app Published
• OAuth client ID: Web application
• Redirect URI https://auth.curupira.api.br/sso/google/callback (exact)
• Client ID + Client Secret entered in SSO Connections