Help

Google Auth Module Provider

In this guide, you’ll learn about the Google Auth Module Provider and how to install and use it in the Auth Module.

The Google Auth Module Provider allows you to authenticate users with their Google account.

Register the Google Auth Module Provider#

Create a project in Google Cloud.↗Create Oauth client ID credentials. When setting the Redirect Uri, set it to a URL in your frontend (for example, storefront) that later uses Medusa's callback route to validate the authentication.↗

To use the Google Auth Module Provider, add the module to the array of providers passed to the Auth Module in your medusa-config.ts:

medusa-config.ts
import { Modules, ContainerRegistrationKeys } from "@medusajs/framework/utils"

// ...

module.exports = defineConfig({
  // ...
  modules: [
    // ...
    {
      resolve: "@medusajs/medusa/auth",
      dependencies: [Modules.CACHE, ContainerRegistrationKeys.LOGGER],
      options: {
        mfa: {
          encryption_key: process.env.AUTH_MFA_ENCRYPTION_KEY,
        },
        providers: [
          // other providers...
          {
            resolve: "@medusajs/medusa/auth-emailpass",
            id: "emailpass",
          },
          {
            resolve: "@medusajs/medusa/auth-google",
            id: "google",
            options: {
              clientId: process.env.GOOGLE_CLIENT_ID,
              clientSecret: process.env.GOOGLE_CLIENT_SECRET,
              callbackUrl: process.env.GOOGLE_CALLBACK_URL,
            },
          },
        ],
      },
    },
  ],
})

Environment Variables#

Make sure to add the necessary environment variables for the above options in .env:

Code
GOOGLE_CLIENT_ID=<YOUR_GOOGLE_CLIENT_ID>
GOOGLE_CLIENT_SECRET=<YOUR_GOOGLE_CLIENT_SECRET>
GOOGLE_CALLBACK_URL=<YOUR_GOOGLE_CALLBACK_URL>

Module Options#

Configuration	Description	Required
`clientId`	A string indicating the Google API Client ID.	Yes
`clientSecret`	A string indicating the Google Client Secret.	Yes
`callbackUrl`	A string indicating the URL to redirect to in your frontend after the user completes their authentication in Google. At this URL, the frontend will receive a `code` query parameter. It then sends that `code` query parameter to the Medusa application's `/auth/{actor_type}/google/callback` route.	Yes

Configuration

Description

Required

clientId

A string indicating the Google API Client ID.

Yes

clientSecret

A string indicating the Google Client Secret.

Yes

callbackUrl

A string indicating the URL to redirect to in your frontend after the user completes their authentication in Google.

At this URL, the frontend will receive a code query parameter. It then sends that code query parameter to the Medusa application's /auth/{actor_type}/google/callback route.

Yes

Allow the Google Provider for Customers#

By default, customers and other custom actor types can authenticate with any registered Auth Module Provider, whereas admin users can only authenticate with the emailpass provider. If you deploy your application to Cloud, admin users can also authenticate with their Cloud account.

To specify the actor types that can use the Google Auth Module Provider, set the authMethodsPerActor configuration in medusa-config.ts:

medusa-config.ts
module.exports = defineConfig({
  projectConfig: {
    http: {
      authMethodsPerActor: {
        user: ["emailpass"],
        customer: ["emailpass", "google"],
      },
      // ...
    },
    // ...
  },
  // ...
})

This configuration allows customers to authenticate with their email and password or with Google, and admin users to authenticate with their email and password only.

Warning: Don't add google to the user actor type. Any Google account can authenticate with this provider, and it doesn't have an option to restrict the accounts that can authenticate. So, if you allow the user actor type to use it, anyone with a Google account can become an admin user of your store. Learn more in the Auth Module Provider guide.

Override Callback URL During Authentication#

In many cases, you may have different callback URLs for actor types. For example, you may redirect admin users to a different URL than customers after authentication.

The Authenticate or Login API Route can accept a callback_url body parameter to override the provider's callbackUrl option. Learn more in this documentation.

Examples#

How to implement Google social login in the storefront

Was this page helpful?