Google OIDC

Create an OAuth Client ID of type Web application in Google Cloud Console. Register https://email.hexascore.app/auth/google/callback as an authorized redirect URI. In testing mode, add aleexgvieira@gmail.com as a test user.

Set SOCIAL_GOOGLE_CLIENT_ID and SOCIAL_GOOGLE_CLIENT_SECRET. Vukem validates single-use state, PKCE, nonce, ID token signature, issuer, audience, and expiration. An administrative session is created only for the authorized, verified address.

OAuth tokens are neither sent to the frontend nor persisted by the application. Production has no alternative sign-in endpoint.