The Starter package is free: €0 a month, with 30 minutes to try it on real calls.The Starter package is free. Get started free

Voiceland AI

Documentation / Guides

Step-by-step guide to Google and Apple sign-in

How to create the Google OAuth client and the Apple Services ID and key that Sign-in on your domain asks for, click by click.

Last updated:

This guide is for the administrator of a white-label account. It walks you through what to create at Google and at Apple so that your customers can use Continue with Google and Continue with Apple on your own domain. You do each part once. Jump to Google or Apple below, and finish in Settings > Sign-in on your domain.

Both providers need two addresses from you. Settings > Sign-in on your domain shows them for your domain, each with a copy button: always copy them from there and paste them, never type them, because a single wrong character makes the provider refuse the sign-in. They look like this, for orientation only:

  • JavaScript origin: your domain with https in front and nothing after it (no path, no final slash)
  • Google return address (redirect URI): <your domain>/gorouter/ai/wl/oauth/google/callback
  • Apple return address (Return URL): <your domain>/gorouter/ai/wl/oauth/apple/callback

Google and Apple rename their menus from time to time. If a label below is not exactly what you see, look for the closest one: the steps stay the same.

Google#

You need a Google account that you control. The basic sign-in this uses asks only for the customer's name, email address and profile picture (the openid, email and profile scopes), and nothing else.

1. Sign in and choose a project#

  1. Open the Google Cloud Console (console.cloud.google.com) and sign in with your Google account.
  2. In the project picker in the top bar, choose a project, or choose New project, give it a name and create it. Make sure that project is the one selected before you continue.

This is the screen Google shows your customers. It lives under Google Auth Platform.

  1. Open Google Auth Platform and click Get started.
  2. App information: enter the app name your customers will recognise (your own brand, not ours) and a support email address.
  3. Audience: choose External. Internal lets only accounts of your own Google Workspace organization sign in, which is not what you want for customers.
  4. Contact information: enter an email address where Google can write to you about the project.
  5. Accept the user data policy and click Create.

3. Add test users, or publish the app#

A new app starts in Testing. In that state Google limits sign-in to the addresses you list, up to 100 of them.

  • To list them, open Audience, find Test users and add every Google address that will sign in. Do this for yourself and for anyone who tries the sign-in before you publish.
  • To let every customer sign in, publish the app: in Audience, change the publishing status from Testing to In production with the publish button. Because this sign-in uses only the basic openid, email and profile scopes, Google does not require a review of your scopes and does not show customers an "unverified app" warning. Google may still ask you to verify your brand before it shows your app name and logo on the consent screen: the Verification Center in Google Auth Platform tells you if it does.

4. Create the client#

  1. In Google Auth Platform open Clients and click Create client.
  2. For Application type choose Web application and give it a name.
  3. Under Authorized JavaScript origins, click Add URI and paste the JavaScript origin copied from Settings > Sign-in on your domain.
  4. Under Authorized redirect URIs, click Add URI and paste the Google return address copied from the same place.
  5. Click Create.

5. Copy the Client ID and the Client secret#

Google now shows the Client ID and the Client secret. Copy both at once. For a new client Google shows the secret only at this moment and keeps just its last four characters afterwards. If you lose it, create a new secret on the client's page.

6. Finish in the settings#

In Settings > Sign-in on your domain, paste the Client ID and the Client secret into the Google section, switch Google on and save.

If Google refuses#

  • The console does not accept the return address because of its domain: open Branding, find Authorized domains and add your domain, then add the address again.
  • redirect_uri_mismatch right after you created the client: Google can take from a few minutes up to a few hours to apply a change. Wait and try again. If it stays, compare the address in the client with the one in the settings, character by character.
  • Access is blocked for one person only: if the app is still in Testing, add that person's address under Test users, or publish the app.

Apple#

You need a paid membership of the Apple Developer Program: without it Apple does not let you create these items. All the steps below are in your Apple Developer account (developer.apple.com/account), under Certificates, Identifiers & Profiles.

1. An App ID with Sign in with Apple#

Apple ties a website to an App ID. If your account already has an App ID with Sign in with Apple enabled, use it and go to the next step. Otherwise:

  1. Open Identifiers and click the add button (+).
  2. Choose App IDs, then the App type, and continue.
  3. Enter a description and a bundle ID of your choice, for example in the form com.yourcompany.signin.
  4. In the list of capabilities, tick Sign in with Apple, then continue and register.

2. Create the Services ID#

  1. In Identifiers, click the add button (+), choose Services IDs and continue.
  2. Enter a description and an identifier of your choice, for example com.yourcompany.signin.web. This identifier is your Services ID: write it down.
  3. Continue and register, then open the new Services ID from the list.
  4. Tick Sign in with Apple and click Configure.
  5. As the Primary App ID choose the App ID from the previous step.
  6. In the website URLs, add your domain under Domains and Subdomains, without the https prefix, for example app.yourcompany.com.
  7. Under Return URLs paste the Apple return address copied from Settings > Sign-in on your domain.
  8. Click Done, then Continue, then Save.

3. Create the key#

  1. Open Keys and click the add button (+).
  2. Enter a key name and tick Sign in with Apple, then click Configure next to it.
  3. Choose the same primary App ID and save.
  4. Continue and register the key.
  5. Click Download and keep the file, which ends in .p8. Apple lets you download it only once. A primary App ID can have at most two keys.
  6. Note the Key ID shown for the key.

4. Find your Team ID#

Open Membership details in your developer account. The Team ID, ten characters long, is listed there.

5. Finish in the settings#

In Settings > Sign-in on your domain, enter the Services ID, the Team ID and the Key ID in the Apple section, upload the .p8 file, switch Apple on and save.

Good to know#

  • Apple sends a customer's name only the first time they sign in, and not again afterwards.
  • A customer can choose to hide their email. Apple then gives a private relay address that forwards to the real one.
  • For your email to reach those relay addresses, register the domain or the address you send from under Sign in with Apple for Email Communication: in Certificates, Identifiers & Profiles open Services, click Configure next to it and add it under Email Sources. Also publish an SPF record for that domain, as Apple asks.
  • If Apple refuses the sign-in, check that the domain and the return address in the Services ID are exactly the ones shown in the settings, and that the key was not revoked.

When you are done#

Switch a method on only after its fields are filled, then save. Try it in a private browser window on your own domain. The short overview of the feature is in the article Sign-in on your domain with Google, Apple or an email code.

The console

These pages are read only. The test call, the API keys and the live API reference are in the console, where your account is signed in.

Open the console