Google Sign-In

Overview

Sign-In uses Supabase Auth with openid, email and profile only. It does not grant Gmail access. Sessions use Secure, HttpOnly, host-only cookies on app.mailraft.com.

Setup & requirements

The deployed Auth configuration determines the Google callback. The production generator configures https://app.mailraft.com/auth/callback and the application exchange at https://app.mailraft.com/api/auth/google/callback. Console registration and owner consent must be verified separately.

Usage & verification

This login requests openid, email and profile only. The callback is https://app.mailraft.com/auth/callback; after Supabase validates the response, the application exchanges PKCE at https://app.mailraft.com/api/auth/google/callback. Site URL is https://app.mailraft.com/workspace. A Gmail connection is not created by signing in.

Cancel consent to return to a generic login error. Expired or replayed callbacks require a new login. Issuer, audience, signature, session status and tenant membership are checked server-side; the callback is not an arbitrary redirect endpoint.