Google Sign-In: Client ID, profile callback, and ID token verification

Documentation:

• open_in_new Sign-In for Websites
• open_in_new Add a Sign-In button
• open_in_new Build a custom button

How it works

For each site you create an application with its own Client ID. The frontend asks the user for authorization; after they approve, your callback runs:

function onSignIn(googleUser) {
  var profile = googleUser.getBasicProfile();
  console.log('ID: ' + profile.getId()); // Do not send to your backend! Use an ID token instead.
  console.log('Name: ' + profile.getName());
  console.log('Image URL: ' + profile.getImageUrl());
  console.log('Email: ' + profile.getEmail()); // null if the email scope is missing
}

Do not POST those profile fields to your backend over AJAX — they are easy to forge.

Send the ID token instead. On the server, verify it (e.g. with verifyIdToken) and only then trust the identity claims.

Important

verifyIdToken depends on correct server time. If the clock is wrong, verification fails.