Authentication

Google Sign-In

Replace difficult WebView OAuth prompts with native Google account selection and return profile, code, or ID token data to the website.

Before you start

Create the Android OAuth client
In Google Cloud, use the exact package name and signing SHA-1. Direct APK tests use the dashboard keystore SHA-1; Play installs normally use the Play App Signing SHA-1.
Confirm the Web client
Use the website OAuth Web Client ID when your backend validates ID tokens or exchanges server auth codes.
Save settings
Enter Android Client ID and optional Web Client ID, redirect URI, and scopes, then save and rebuild.
Trigger native sign-in
Use webtoapp.googleSignIn(options) or the google_sign_in message. The shell can also recognize supported Google OAuth navigation patterns.
Validate on the server
Send the returned code or id_token to your backend, validate issuer, audience, expiry, signature, and state, then establish the website session.
Test both signing identities
Test a directly installed APK and a Play testing-track install because their certificate fingerprints can differ.

webtoapp.googleSignIn({
  web_client_id: "WEB_CLIENT_ID",
  scope: "openid email profile",
  response_type: "code"
});

webtoapp.onmessage receives type google_sign_in with profile fields and optional code or id_token, or an error.