Google sign-in

Sign in with Google gives your app an ID token, a JWT signed by Google, for each account that signs in. @mayurajs/auth-google offers two ways to use it with Mayura:

• googleAuthenticator: ID tokens sent straight to Mayura's server as bearer tokens, checked as Google advises. It is a jwtAuthenticator set up for your client IDs, and your identity mapping decides what each account may do.
• googleSignIn: Google as a social login for better-auth, asking no more than signing in needs.

It verifies tokens with mayura/auth's own JWT verifier (WebCrypto only): no Google SDK, no dependency, and it runs on every runtime Mayura runs on.

#Install

npm install mayura @mayurajs/auth-google

#Credentials

Create an OAuth client ID in the Google Cloud console under APIs & Services > Credentials. googleAuthenticator needs only the client ID (or several, for web and mobile clients), which is not secret. googleSignIn also needs the client's secret, which stays on your server.

The package reads nothing from the environment: pass the values in yourself, for example from GOOGLE_CLIENT_ID.

#Use it

import { principalId } from 'mayura/auth';
import { googleAuthenticator } from '@mayurajs/auth-google';

export const authenticate = googleAuthenticator({
  clientIds: [process.env.GOOGLE_CLIENT_ID ?? ''], // 1234567890-abc.apps.googleusercontent.com
  hostedDomain: 'acme.com',                          // only Workspace accounts of acme.com
  identity: session => session.emailVerified ? {
    principalId: principalId('google', session.userId),
    projectId: 'acme',
    agentIds: ['support'],
    capabilities: ['runs:submit', 'runs:read'],
  } : null,
});
// createAgentServer({ ..., authenticate })

Clients send the ID token (the credential from Google Identity Services, or a mobile app's Google sign-in) as the bearer token. Key users on session.userId, the stable account id; Google advises against keying users on email.

To have users sign in to your own application with better-auth instead, pass googleSignIn as its Google provider:

import { betterAuth } from 'better-auth';
import { googleSignIn } from '@mayurajs/auth-google';

export const auth = betterAuth({
  socialProviders: {
    google: googleSignIn({
      clientId: process.env.GOOGLE_CLIENT_ID ?? '',
      clientSecret: process.env.GOOGLE_CLIENT_SECRET ?? '',
      hostedDomain: 'acme.com',
    }),
  },
});

#Options

googleAuthenticator:

googleSignIn:

googleSignIn always sets includeGrantedScopes: false, so a sign-in asks only for this sign-in's scopes.

#What is checked

• Signature. RS256 with Google's keys from https://www.googleapis.com/oauth2/v3/certs (exported as googleJwksUrl), kept for the response's max-age, at most 10 minutes.
• Issuer. https://accounts.google.com or accounts.google.com: Google writes it both ways.
• Audience. One of your clientIds.
• Times. The token must carry exp and be unexpired, with clockSkewMs of leeway.
• Account. A token without sub is refused. With hostedDomain, a token without hd (a consumer account) or with another domain is refused.

See Tokens from an identity provider for the key cache, timeouts and size limits.

#What identity receives

googleSession(claims) is exported for checks of your own.

#Errors

#How it is tested

• Unit tests sign real RS256 tokens and serve their JWKS at Google's URL through a fake fetch. They check both issuer spellings, several client IDs, that tokens for another client, issuer or key are refused, that hostedDomain keeps to one domain (or any Workspace domain with *), and that googleSignIn asks for online access and no granted scopes unless told otherwise.
• scripts/live/auth-google.mjs fetched and checked Google's published signing keys on October 6, 2026. A real ID token has not been verified with it yet.

#Related

• Authentication and API keys: the verifier, key caching and identity mapping.
• Sign-in with better-auth: sign-in on your own database.
• Firebase Authentication ID tokens and Facebook Login: other consumer sign-in.