Aeion Auth + Google — SSO in 10 Minutes
Drop "Sign in with Google" onto your Aeion deployment using the built-in `google` OAuth provider. Works for consumer Gmail + Google Workspace (with optional domain restriction). PKCE-secured by default. No per-user billing meter — Aeion handles the entire flow with zero markup.
When This Integration Matters
Google SSO is the default for almost every B2B-SaaS, B2C, and prosumer use case. Three deployment shapes:
Step 1 — Google Cloud Console Setup
Create the OAuth 2.0 Client ID in Google Cloud Console.
Step 2 — Aeion Auth Config
Three env-vars, then restart the API.
What the Flow Looks Like
End-to-end shape from the user's perspective.
Common Gotchas
- "redirect_uri_mismatch" — the redirect URI in Google Cloud Console must match EXACTLY (including trailing slash, http vs https, port). Aeion's redirect URI is
https://<host>/api/auth/oauth/google/callback— no trailing slash.
FAQ
Not via configuration today — there's no env var or built-in `hd` enforcement. Aeion stores whatever Google returns in the user's profile data (including `hd` for Workspace accounts), so you can check it yourself post-sign-in if you need domain restriction.
Aeion looks up existing users by email during the OAuth callback — if a user with that email already exists, the Google connection links to that existing account rather than creating a duplicate.
Not via configuration today — Aeion requests the fixed default scope set (`openid`, `email`, `profile`) on every Google sign-in; there's no env var to add extra scopes.
Aeion uses the standard OAuth 2.0 + OIDC flow because it's the industry standard and works for non-browser clients (mobile, CLI, etc.). GSI is a browser-only convenience layer on top; not on the auth roadmap.
Two paths: (1) user can self-revoke from `/admin/profile/connections`, which disconnects the account directly, OR (2) at the Google account side via `https://myaccount.google.com/permissions`. Aeion detects the next failed token refresh, marks the connection as disconnected, and logs the event to your sign-in history.