Open the Google Cloud Console and create or select a project. Find Google Auth Platform or the OAuth consent configuration area; console labels may change over time.

Set the app name, support email, developer contact, and audience. While the app is in testing mode, add test users if required. Request only identity scopes needed for sign-in (openid, email, profile). Google sign-in does not require Gmail or Drive access.

In the Google Auth Platform / Clients area, create an OAuth client of type Web application. For local development add authorized JavaScript origin http://localhost:3000 and authorized redirect URI http://localhost:3000/api/auth/callback/google. For production add your real HTTPS origin and exact callback URL, e.g. https://app.your-domain.example/api/auth/callback/google.

Copy the Client ID and Client Secret from the Google console into .env.local as GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET. The Client ID identifies the OAuth client; the secret is confidential and must remain on the server.

The browser starts sign-in, NextAuth redirects to Google, Google authenticates the user, then redirects to the registered callback. NextAuth validates the OAuth response, runs callbacks, and establishes the app session. Use the NextAuth session to identify the user; do not treat Google's access token as your app session.

redirect_uri_mismatch: compare the exact callback URL with Google Cloud. invalid_client: verify the client ID and secret belong together. Access blocked: check audience, test-user list, and publishing status. Wrong callback host: verify NEXTAUTH_URL and reverse-proxy host/protocol settings. Restart or redeploy after changing environment variables.