# Set up Google sign-in for connections

Add your Google app once, so everyone on the installation can connect Google apps.

Google’s apps, such as Gmail and Google Sheets, connect by signing in with Google. On your installation, that sign-in goes through a Google app of your own. Other apps that sign in, such as Microsoft Outlook, Slack or HubSpot, work the same way with their provider’s app: see [Other providers](https://docs.gorunner.io/self-host/oauth-apps#other-providers).

## Copy the redirect address

1. Open the menu at the bottom of the sidebar, then **Platform**.
2. Under **Settings**, open **OAuth apps**.
3. Under **Redirect address**, press **Copy**. It is your address followed by `/api/oauth2/callback`.

![OAuth apps: the Redirect address with Copy, and Google under Sign-in apps, Not set up, with Set up….](https://docs.gorunner.io/img/self-host/oauth-apps-light.jpg)

## Make the app in Google Cloud

1. In your Google Cloud project, turn on the APIs of the apps you’ll use, such as the Gmail API and the Google Sheets API.
2. Set up the OAuth consent screen for your users.
3. Create an OAuth client ID of the type **Web application**, and add the redirect address under its authorized redirect URIs.
4. Keep its client ID and client secret.

> **Note** An app left in Testing signs everyone out after 7 days. Publish it in Google Cloud.

## Add it to GoRunner

1. Back on **OAuth apps**, next to **Google**, press **Set up…**.
2. Paste the **Client ID** and the **Client secret**, and press **Save**.
3. Type your two-factor code.

You should see “Saved the Google app. New sign-ins use it now.” Google’s row reads **Set here**, with the secret’s last four characters.

## Check it worked

In **Connections**, connect Google Sheets and press **Sign in with Google**. Google’s window opens on your app.

## Other providers

**Sign-in apps** has one row per provider your apps sign in with, such as Microsoft, Slack or HubSpot. Each is set up the same way: make an app in the provider’s developer settings, add the redirect address to it, then press **Set up…** on the provider’s row and paste its **Client ID** and **Client secret**. Until a provider has an app, its apps say that sign-in isn’t set up here; those that also take a token of the person’s own offer that instead.

**Can I do this from the editor instead?**

Yes. A platform admin who connects a Google app before it is set up sees **Set up Google sign-in**, with the same redirect address. Paste the client ID and secret and press **Save and sign in**.

Anyone else sees “Google sign-in isn’t set up here”, with an admin to ask.

**What if I change or remove the app later?**

**Change…** takes a new client ID; leave the secret empty to keep it. A different app stops the connections signed in with the old one from refreshing: they need signing in again.

**Remove…** does the same to them. New sign-ins then use the server’s own app, if `.env` has one; without it, nobody can connect Google.

**What does “From server settings” mean?**

The app comes from `OAUTH_MANAGED_GOOGLE_CLIENT_ID` and `OAUTH_MANAGED_GOOGLE_CLIENT_SECRET` in `.env`, or `OAUTH_MANAGED_<PROVIDER>_CLIENT_ID` and `_SECRET` for another provider, such as `MICROSOFT` or `SLACK`. An app set here takes its place for new sign-ins. On Kubernetes, put them under `config` and `secretConfig`.

## Related

- [Google Sheets](https://docs.gorunner.io/apps/google-sheets): Connect it, and what it can do
- [Connections](https://docs.gorunner.io/build/connections): Sign in again, test and share · 4 min
- [The Platform console](https://docs.gorunner.io/self-host/platform): Every page, in one place · 5 min

Source: https://docs.gorunner.io/self-host/oauth-apps