Adding “Sign in with Google” to an app your AI built: the 6 steps the agent can’t do for you
The code for Google sign-in is the easy part, and agents write it well. What fails is the setup on Google's side, and that part needs you.
The six steps
- Make a Google Cloud project. Open the Cloud console, create a new project, any name.
- Set up the consent screen. This is the screen people see when they sign in. Choose External if anyone with a Google account should be able to use your app. Add the app name and a support email.
- Create an OAuth client of type Web application. You get a client ID and a client secret.
- Add the redirect URIs. This is the number one source of errors. The redirect URI must match what your auth library sends, character for character: scheme, host, path, trailing slash. Add the localhost one for testing and the production one for the live app.
- Put the ID and secret in environment variables on the server. Never in the frontend code and never in git.
- Publish the app. Google keeps a new consent screen in Testing mode. In that mode only people on your test-user list can sign in (up to 100), and a test user's authorization expires after 7 days. Switch the app to In production so anyone can use it.
Errors and what they mean
- redirect_uri_mismatch The URI in step 4 does not match. Compare it with the exact URL shown in the error.
- Access blocked, or “not a test user” The app is still in Testing mode. Do step 6.
- Works on localhost, fails when live The production redirect URI was never added.
Basic sign-in asks only for name, email and profile. Google asks for extra verification when an app requests sensitive or restricted scopes, which plain sign-in does not need.
Prompt: add Google sign-in without the Google console
Paste this into Claude Code, Cursor, Codex or any agent that can run commands.
Read https://portal.traceshield.app/agent.md and follow it. Add Google sign-in to this app using Traceshield's built-in sign-in, so I do not have to set up anything in the Google console. Protect the pages that need a signed-in user on the server, show who is signed in with a sign-out link, then deploy and tell me the live URL.
What Traceshield does here, and what it doesn’t
With Traceshield the sign-in is already registered, so steps 1 to 4 and step 6 are skipped: the agent reads the credentials from the environment and the callback address is set for you, locally and live. If you want your own Google project, the six steps above still apply.
More guides
Updated 2026-10-27. Written by the Traceshield founder.