Skip to main content

Google Sign-In

POST /v1/users/auth/google

Auth: None

FieldTypeRequiredDescription
idTokenstringYesID token from Google Sign-In, obtained client-side
curl -X POST https://api.2settle.io/v1/users/auth/google \
  -H "Content-Type: application/json" \
  -d '{ "idToken": "eyJhbGciOiJSUzI1NiIs..." }'
{
  "success": true,
  "data": {
    "user": { "...": "same shape as OTP verify" },
    "accessToken": "eyJhbGciOi...",
    "refreshToken": "2c8e1a4f...",
    "expiresInSec": 900
  }
}

Notes:

  • The server verifies idToken was issued for one of your app's registered Google OAuth client IDs, so the same backend accepts tokens minted by any of your app's platforms (web, iOS, Android).
  • If the token's email is verified by Google and already belongs to an existing user (from a prior email-OTP login), the Google identity links to that account — same user.id either way, no duplicate account.
  • Otherwise creates a new user, seeded with the Google profile's displayName/avatarUrl, and (if the email is verified) also links an email identity so that user can later log in with email OTP too.
  • An invalid/unverifiable token fails with INVALID_GOOGLE_TOKEN (401).