Google Sign In

Google Sign-In

Plum can let people sign in with Google instead of (or alongside) an email and password. It is off by default and only an owner can turn it on, in Settings → Users → Sign-in options.

Google sign-in in Plum is deliberately narrow:

• It only signs in an account an owner has already added under Settings → Users — the Google email must match a Plum user's email. There is no automatic account creation.
• The Google identity is linked to that Plum user on their first Google sign-in, and is fixed after that.
• Unverified Google emails are refused.

What you need

A Google account that can create an OAuth client — a personal Google account works, a Google Workspace admin account works. You do not need Google Workspace.

1. Create an OAuth client in Google Cloud

1. Open the Google Cloud console and pick or create a project.
2. APIs & Services → OAuth consent screen. Choose Internal if this is a Workspace org and only your own domain will sign in, otherwise External. Fill in the app name and a support email; you can leave the optional fields blank. Add the scopes openid, .../auth/userinfo.email, .../auth/userinfo.profile if prompted (Plum requests exactly these). For an External app, add each person's Google email as a test user, or publish the app.
3. APIs & Services → Credentials → Create credentials → OAuth client ID.
   • Application type: Web application.
   • Authorized redirect URIs: paste the URI Plum shows you (next section). It is your backend URL plus /auth/google/callback, e.g. https://api.plum.example.com/auth/google/callback, or http://localhost:3001/auth/google/callback for a local install.
4. Copy the Client ID and Client secret.

2. Enter the credentials in Plum

Settings → Users → Sign-in options (owner only):

1. Copy the Authorized redirect URI shown on the card and make sure it is listed on the OAuth client from step 1. They must match exactly, including http/https and the port.
2. Paste the Google client ID and Google client secret.
3. Turn on Sign in with Google and Save. The toggle stays disabled until both a client ID and a secret are present.

The client secret is write-only: after saving, the field shows "Leave blank to keep the current secret" and the API never returns the value again. Re-enter it only to change it.

3. Sign in

The login screen now shows a Sign in with Google button. If email/password is still enabled it shows both, with the button below the form.

Turning password sign-in off

You can disable Email & password once Google sign-in works, so everyone uses Google. Plum will not let you disable the last remaining method — at least one is always on.

If password sign-in is off, POST /auth/login returns 403 and the login form is hidden.

Behind a reverse proxy

plum server passes your API URL to the backend, so the redirect URI is <your API URL>/auth/google/callback — register exactly that. If you added Google sign-in on an older version, run plum server restart once after updating so the backend picks the URL up.

Only if you run your own docker-compose (not plum server) does Plum fall back to guessing from the request headers. In that case forward X-Forwarded-Proto / X-Forwarded-Host from your proxy, or set PLUM_OAUTH_REDIRECT_URI to the exact URI — see Setting Up the Server.

Backups

A backup carries the on/off toggles and the client ID, but not the client secret. After restoring into a fresh server, re-enter the secret and re-enable Google sign-in; until then a restore leaves it off.

Troubleshooting

Symptom	Cause
redirect_uri_mismatch from Google	The redirect URI on the OAuth client doesn't exactly match what Plum sent. Copy it from the Sign-in options card again.
"No Plum account for …"	The Google email isn't a Plum user. An owner adds it under Settings → Users first.
"This account is linked to a different Google identity."	The Plum user already signed in with a different Google account. An owner can clear it by removing and re-adding the user, or by editing User.googleId in the database.
Button doesn't appear	Google sign-in isn't enabled, or the client ID/secret is missing.
"Access blocked" on Google's screen	The consent screen is in testing and the email isn't a listed test user, or the app needs verification for that scope set.