docs(infra): Google sign-in go-live checklist #4078
1 changed file+96−0
Addeddocs/infra/google-signin-setup.md+96−0View fileUnifiedSplit
@@ -0,0 +1,96 @@
1# Google Sign-In — Go-Live Checklist
2
3**TL;DR:** The Google login code is fully built and your Google Cloud console is configured
4correctly. Nothing is wrong with either. Login fails today (Google AND email/password)
5because the API server isn't deployed yet — every sign-in method talks to
6`api.alecrae.com`, and nothing is listening there. Complete the steps below and both
7methods light up at once.
8
9---
10
11## What's already done ✅
12
13| Piece | Status |
14|---|---|
15| "Sign in with Google" button on `/login` | Built (PR #48) |
16| API routes `/v1/auth/google` + `/v1/auth/callback/google` | Built |
17| Web callback page `/google/callback` (stores session, routes to inbox) | Built |
18| Email + password login (`POST /v1/auth/login`) | Built |
19| Passkey login (WebAuthn) | Built |
20| Google Cloud OAuth client (ID `555087940429-p9qr1ds4pl7b21j8cvvm41itog7rf9qj`) | Created 9 June 2026 |
21| Authorised JS origins: `https://mail.alecrae.com`, `https://api.alecrae.com` | ✅ matches code |
22| Redirect URI: `https://api.alecrae.com/v1/auth/callback/google` (sign-in) | ✅ matches code default |
23| Redirect URI: `https://api.alecrae.com/v1/connect/callback/gmail` (mailbox connect) | ✅ matches code default |
24
25## What's blocking login ❌
26
271. **The API isn't deployed.** `https://api.alecrae.com` doesn't respond. The web app's
28 `NEXT_PUBLIC_API_URL` isn't set on Vercel, so the login page tries `localhost:3001`
29 — which is why every method shows "Can't reach the server right now."
302. **No production database.** Login needs Neon Postgres (`docs/infra/neon-setup.md`).
31
32---
33
34## Step 1 — Recover the client secret (do this first, 2 min)
35
36Google no longer lets you view a secret after creation (yours shows as `****1SgB`).
37**If you didn't copy it on 9 June when you created the client:**
38
391. On the Client ID page you're already on → **Client secrets** → **Add secret**
402. Copy the new `GOCSPX-...` value IMMEDIATELY and store it in your password manager
413. Delete the old secret once the new one is deployed
42
43The secret goes in the API's env as `GOOGLE_CLIENT_SECRET`. Never commit it.
44
45## Step 2 — Provision the database
46
47Follow `docs/infra/neon-setup.md` → gives you `DATABASE_URL`. Run `bun run db:migrate`.
48
49## Step 3 — Deploy the API and point DNS
50
51Follow `docs/infra/craig-go-live.md` Phase 5. Whatever host runs `apps/api`, point
52`api.alecrae.com` at it in Cloudflare DNS. Minimum env vars for login to work:
53
54```bash
55DATABASE_URL=<from Neon>
56JWT_SECRET=<random 64 bytes, base64>
57WEB_URL=https://mail.alecrae.com
58GOOGLE_CLIENT_ID=555087940429-p9qr1ds4pl7b21j8cvvm41itog7rf9qj.apps.googleusercontent.com
59GOOGLE_CLIENT_SECRET=<from Step 1>
60# Optional — defaults already match your console:
61# GOOGLE_AUTH_REDIRECT_URI=https://api.alecrae.com/v1/auth/callback/google
62```
63
64Full list: `docs/infra/.env.production.template`.
65
66## Step 4 — Tell the web app where the API lives
67
681. vercel.com → AlecRae project → **Settings → Environment Variables**
692. Add `NEXT_PUBLIC_API_URL` = `https://api.alecrae.com` (Production)
703. **Redeploy** (Deployments → ⋯ → Redeploy) — `NEXT_PUBLIC_*` vars bake in at build time
71
72## Step 5 — Test
73
741. Open `https://mail.alecrae.com/login`
752. Click **Sign in with Google** → pick your account → should land in `/inbox`
763. Sign out, then test email + password
77
78---
79
80## Having BOTH Google and password login (your "just in case" setup)
81
82Google sign-in matches accounts **by email address**, so both methods reach the same
83account automatically:
84
85- **If you register with email + password first**, then click "Sign in with Google"
86 using the same address → Google signs into that same account. You now have both.
87- **If your account was created BY Google sign-in**, it has no password yet
88 (`passwordHash` is null) — there's currently no self-serve "set a password" screen.
89
90**Recommended for your account:** once the API is live, register at `/register` with
91your email + a password, then use "Sign in with Google" with the same address. From
92then on, either method works, plus passkeys as a third fallback.
93
94---
95
96_Last updated: 2026-06-10 08:05 UTC_
097
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts