AI Library // 01

Google-onlysign-in.

A practical reference for connecting Google, Supabase Auth, and a Vercel-hosted app without collecting usernames or passwords.

For agents

The job in one pass

Use Supabase Auth with Google OAuth only.
Keep email/password and other providers disabled.
Put only the Supabase URL and publishable key in Vite client variables.
Add the exact production redirect URL to Supabase.
Protect future paid data with server checks and Row Level Security—not a hidden button.

Plain English first

Who does what?

Google

Confirms who a person is. The site never receives or stores their Google password.

Supabase Auth

Creates the app account and manages the signed-in session after Google approves it.

Vercel

Builds and hosts the site with the connection settings supplied outside the source code.

The setup

Four pieces that must agree.

01
Create the Google OAuth client
In Google Cloud, create a web OAuth client. Register the callback URL shown by Supabase: https://<project-ref>.supabase.co/auth/v1/callback. Put the Google client ID and secret in Supabase, never in the website.
02
Make Supabase Google-only
Enable Google under Authentication → Sign In / Providers. Disable email/password and every provider you do not intend to support. Keep user signups enabled if a first Google sign-in should create an account.
03
Allow the return trip
Under Authentication → URL Configuration, add the production URL and any intended local or preview URLs to Redirect URLs. The value passed as redirectTo must match an allowed URL.
04
Set the Vercel variables
Add the project URL and Supabase publishable key to Vercel. Vite exposes VITE_-prefixed values to browser code, so never use that prefix for a service-role key.

The browser-side minimum

A small, explicit sign-in call.

const { error } = await supabase.auth.signInWithOAuth({
  provider: "google",
  options: { redirectTo: window.location.origin },
});

A first successful Google sign-in creates the account in Supabase. There is no separate username, password, or local registration form.

The boundary that matters

A sign-in button is not access control.

When credits, paid tools, or private projects arrive, make the server and database check the signed-in user. Use Supabase Row Level Security keyed to auth.uid(); keep service-role keys server-only; and verify entitlement before every premium action.

Google-onlysign-in.

Who does what?

Four pieces that must agree.

Create the Google OAuth client

Make Supabase Google-only

Allow the return trip

Set the Vercel variables

A small, explicit sign-in call.

A sign-in button is not access control.