Set up and verify Google OAuth for NowStack Mobile web and Expo clients against the shared Better Auth and Convex backend. Use for Google sign-in buttons, Google Cloud OAuth clients, callback URLs, missing GOOGLE_CLIENT_ID or GOOGLE_CLIENT_SECRET, or production Google auth rotation.
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
<read_first> Read the auth feature flag and the real provider implementation before changing anything:
rg -n "enableGoogleSignIn|GOOGLE_CLIENT|google|getEnabledAuthProviders|CONVEX_SITE" \
site-config.ts convex mobile-app web-app scripts
npx convex env list | sed 's/=.*$/=<set>/'
npx convex run auth:getEnabledAuthProviders '{}'
For --prod, also run:
npx convex env list --prod | sed 's/=.*$/=<set>/'
npx convex run --prod auth:getEnabledAuthProviders '{}'
Derive {convex_site_host} from the target deployment's .convex.site URL. The callback is always:
https://{convex_site_host}/api/auth/callback/google
</read_first>
<workflow> 1. Confirm `SiteConfig.features.enableGoogleSignIn` is enabled and Google is wired in `convex/auth.ts` plus the provider-availability query. Do not render a client button from the flag alone. 2. Use the user's authenticated Google Cloud session. Prefer `gcloud` for inspection and Chrome for Google Auth Platform steps that have no reliable CLI equivalent. 3. Select or create a dedicated Google Cloud project named from the product. Do not reuse an unrelated company project. In `--prod` mode, create a distinct production OAuth client even when the project is shared. 4. Configure Google Auth Platform branding: product name, support email, contact email, external audience when appropriate, required policy acceptance, and the real privacy/terms URLs for production. Stop only for human-only consent, 2FA, or policy gates. 5. Create an OAuth 2.0 Client ID of type **Web application**. Use an unmistakable name such as `{app} development` or `{app} production` and register the exact callback URL above. 6. If the current Google UI does not reveal the original secret, open the client detail and choose **Add secret**. Capture the new secret once and never put it in chat, logs, screenshots, or git-tracked files. 7. Set the target Convex environment. `SITE_URL` is the browser origin, not the Convex site URL:# development
npx convex env set SITE_URL "http://localhost:3111"
npx convex env set GOOGLE_CLIENT_ID "<client>.apps.googleusercontent.com"
pbpaste | npx convex env set GOOGLE_CLIENT_SECRET
# production (--prod)
npx convex env set --prod SITE_URL "https://<production-app-domain>"
npx convex env set --prod GOOGLE_CLIENT_ID "<production-client>.apps.googleusercontent.com"
pbpaste | npx convex env set --prod GOOGLE_CLIENT_SECRET
On non-macOS systems, use the platform clipboard equivalent or pipe a protected runtime variable to the same value-less convex env set command. Never put the secret literal in the command line.
.env, .env.local, site-config.ts, docs, shell history, or build config.
</workflow>
# development
npx convex run auth:getEnabledAuthProviders '{}'
# production
npx convex run --prod auth:getEnabledAuthProviders '{}'
The result must report google: true. Then:
accounts.google.com, uses the expected client ID, and carries the exact target Convex callback.If the button is absent, check the feature flag, target deployment, both Convex env values, and query result before changing UI code. </verification>
<production_invariant>
A production deployment is blocked until a production-specific Google OAuth client exists, its production callback is registered, its fresh client secret is stored with --prod, and the production provider query returns google: true. Development credentials are not a production shortcut.
</production_invariant>
<success_criteria>
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Complete guide for building beautiful apps with Expo Router. Covers fundamentals, styling, components, navigation, animations, patterns, and native tabs.
The English summary is being prepared. Showing the original description.
Routes general Convex requests to the right project skill. Use when the user asks which Convex skill to use or gives an underspecified Convex app task.
The English summary is being prepared. Showing the original description.
Use when optimizing Convex database read bandwidth, documents-read cost, query indexes, full-table scans, function-level usage dashboard findings, or code that uses .filter(), unbounded .collect(), N+1 reads, or expensive reactive Convex queries.
The English summary is being prepared. Showing the original description.
Build reusable Convex components with isolated tables and app-facing wrappers. Use for defineComponent, app.use, ComponentApi, or shared backend modules.
The English summary is being prepared. Showing the original description.
Plan safe Convex schema and data migrations. Use for widen-migrate-narrow rollouts, backfills, breaking field changes, table splits, or failed schema deploys.
The English summary is being prepared. Showing the original description.
Audit Convex performance for hot reads, write contention, subscriptions, function limits, OCC conflicts, latency, read amplification, and expensive reactive queries.
The English summary is being prepared. Showing the original description.