Provider strategy

vestibule_google

Google OAuth strategy with verified-email handling, hosted-domain enforcement, and refresh-token guidance.

When to use it

Use Google when users sign in with Google or Google Workspace accounts and your app needs normalized profile data.

Default scopes: openid email profile

Install

Until 1.0, install Vestibule packages from GitHub using the movingvestibule-v0.0 tag. This requires Gleam 1.18 or later because companion packages use git path dependencies.

[dependencies]
vestibule_google = { git = "https://github.com/tylerbutler/vestibule.git", ref = "vestibule-v0.0", path = "packages/vestibule_google" }

Setup

Create a Google Cloud project.
Configure OAuth consent screen with openid, email, and profile scopes.
Create a Web application OAuth client ID.
Add development and HTTPS production redirect URIs exactly.

Usage

import vestibule/config
import vestibule_google

let strategy = vestibule_google.strategy()
let cfg =
  config.new(
    client_id: "google-client-id",
    redirect_uri: "http://localhost:8000/auth/google/callback",
    auth: config.ClientSecret("google-client-secret"),
  )

let workspace_strategy =
  vestibule_google.strategy_for_hosted_domain("corp.example")

What Vestibule handles

user_info.email only returns a value when email_verified is true.
config.with_extra_params can request offline access.
strategy_for_hosted_domain validates the hd claim server-side.
The hd authorization parameter alone is only an account-picker hint.

What you handle

Google only returns a refresh token on first consent for a client/user/scope combination.
Use access_type=offline and prompt=consent when requesting refresh tokens.