Back to Overview

Google OAuth App Setup

Create one Google OAuth app for Google Login, Google Calendar sync and Google Meet room creation.

Luka Breitig, Software Engineer & AI Developer
Luka Breitig

Updated 17 June 2026

Before you begin

  • A Google account (personal or Google Workspace)
  • A domain with HTTPS configured (Google rejects plain HTTP redirect URIs)
  • Tymeslot installed and running at your domain

By the end of this guide, one Google Cloud project serves Google Login, Google Calendar sync and Google Meet room creation.

One App, Three Features

One Google Cloud project covers all three Google integrations in Tymeslot, so you only go through this setup once.

  • Google Login: users sign in with their Google account
  • Google Calendar: sync availability and create booking events automatically
  • Google Meet: create a Meet room for every booked meeting automatically

You create and manage this OAuth app in Google Cloud Console (formerly Google Developers Console). All three integrations use the same credentials.

1 Create a Google Cloud Project

  1. Go to console.cloud.google.com.
  2. Click [Select a project] in the top navigation bar, then click [New Project] in the dialog that opens.
  3. Enter a name, such as "Tymeslot", and click [Create].
  4. After a few seconds, the project dashboard opens. Check that the project name appears in the top navigation bar before continuing.

Already have a Google Cloud project?

You can use an existing project. Select it from the [Select a project] picker and continue from Step 2. The remaining steps are the same for new and existing projects.

2 Enable Required APIs

Go to [APIs & Services] → [Library] in the left sidebar and enable the APIs listed below. After you click [Enable], the API's management page opens, and a [Manage] button confirms it is active.

  • Google Calendar API

    Required for Calendar sync.

  • Google People API (optional)

    Tymeslot does not call it: Google Login reads the user's name and email from Google's standard userinfo endpoint, which needs no extra API. You can skip it.

  • Google Meet API

    Required for Google Meet: Tymeslot creates Meet links through this API. Skip it only if you are not using Google Meet.

Enable the APIs one at a time: search by name, click the result card, then click [Enable], and return to the Library for the next one.

3 Configure the OAuth Consent Screen

Navigate to [APIs & Services] → [OAuth consent screen]. This configures the screen your users see when they authorise access to their Google account. Newer versions of the console call this section Google Auth Platform and split the same settings across Branding (app name, authorised domains), Audience (user type, test users, publishing) and Clients (the credentials in Step 4).

  1. User Type: choose External unless your organisation uses Google Workspace and you only want accounts in your organisation to sign in. Click [Create].
  2. Fill in App name ("Tymeslot"), User support email, and Developer contact information.
  3. Under Authorized domains, add your domain (for example, yourdomain.com).
  4. Click [Save and Continue] through the Scopes and Test users screens. Tymeslot requests the scopes it needs during the OAuth flow, so you do not need to add them here.
  5. Review the Summary page. Your consent screen is now saved.

App needs verification

If Google shows an "App needs verification" banner, your app is in testing mode. Add up to 100 accounts under [Test users] so they can sign in while you test. When you are ready to open sign-in to everyone, click [Publish App] and complete Google's verification process. Google reviews apps that request Calendar access more closely, so describe clearly how Tymeslot uses the data.

4 Create OAuth Credentials

Go to [APIs & Services] → [Credentials] → [Create Credentials] → [OAuth 2.0 Client IDs].

  1. Application type: choose Web application.
  2. Name: "Tymeslot" (this label is internal; users do not see it).
  3. Under Authorized redirect URIs, click [Add URI] and add one URI for each feature you use (Login, Calendar, Meet):
    https://yourdomain.com/auth/google/callback
    https://yourdomain.com/auth/google/calendar/callback
    https://yourdomain.com/auth/google/video/callback
  4. Click [Create]. A dialog appears with your Client ID and Client Secret; copy both now. Google may not show the full secret again later; if you lose it, add a new secret to the client.

redirect_uri_mismatch error

If login fails with a redirect_uri_mismatch error, the callback URL registered in Google does not exactly match the one Tymeslot sent. Google's error page shows the URI it received under the error details; add that exact URL to the [Authorized redirect URIs] list. The match is case-sensitive and includes the scheme (https://), port if any, and path with no trailing slash.

5 Configure Environment Variables

Add the following to your Tymeslot environment and restart it. 

# Enable Google Login
ENABLE_GOOGLE_AUTH=true

# OAuth credentials (from the dialog in Step 4)
GOOGLE_CLIENT_ID=123456789-abcdefg.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-xxxxxxxxxxxxxxxx

# Random secret used to sign the OAuth state parameter
GOOGLE_STATE_SECRET=your-random-32-char-secret

Generate a secure state secret with: 

openssl rand -hex 32

ENABLE_GOOGLE_AUTH is optional for Calendar and Meet

Setting ENABLE_GOOGLE_AUTH=true adds the Google button to your sign-in page. Leave it out if you only want Google Calendar or Meet without offering Google sign-in; all three use the same credentials. GOOGLE_STATE_SECRET is the other way round: Calendar and Meet connections need it, while Google Login does not use it.

Common Errors

"Access blocked: [app] has not completed the Google verification process"

Your OAuth consent screen is in testing mode and the account trying to sign in is not in the [Test users] list. Add the user's Google account email under [APIs & Services] → [OAuth consent screen] → [Test users], or publish the app to remove the restriction.

"Access blocked: Authorization Error"

Click the error details link: Google names the cause there, such as a wrong client ID (invalid_client), an unregistered redirect URI, or an unsaved consent screen. For the last, return to Step 2, confirm each API shows a [Manage] button, and repeat Step 3.

Calendar sync fails after login succeeds

Google Login and the Calendar connection are separate OAuth flows: Tymeslot asks for Calendar access only when a user connects Google Calendar from the dashboard. If that step fails, confirm the Google Calendar API is enabled (Step 2), that /auth/google/calendar/callback is among your redirect URIs (Step 4), and that GOOGLE_STATE_SECRET is set.

❓ Frequently Asked Questions

Google shows a 'This app isn't verified' warning. Is that normal?

Yes, for a self-hosted instance that has not been through Google's verification. Users can click [Advanced] and then [Go to (your app name) (unsafe)] to continue, which is acceptable for a private or internal deployment. For a public instance, submit the app for verification from the OAuth consent screen. Google reviews Calendar access more closely, so describe clearly how the data is used.

I added the redirect URI, but Google still returns a redirect_uri_mismatch error. Why?

The URI must match exactly: same scheme (https://), same domain, same path, and no trailing slash. Each feature also has its own URI, so a Calendar or Meet connection needs the matching URI from Step 4. Changes can take a few minutes to apply after saving, so wait and try again, or open the Credentials page to confirm the URI was saved.

Do I need to add test users on the OAuth consent screen?

Only if your app is in Testing publishing status. In Testing mode, only accounts explicitly listed under [Test users] can authorise the app, and everyone else sees an "Access blocked" error. To open sign-in to any Google account, click [Publish App] on the OAuth consent screen to switch to In production status.

What's the difference between the 'Internal' and 'External' user type?

Internal limits sign-in to accounts in your Google Workspace organisation; nobody outside it can authorise the app. External allows any Google account to sign in, subject to your publishing status (Testing or In production). Choose Internal if Tymeslot is only for your team and everyone has a Google Workspace account in your organisation.

My Google OAuth credentials stopped working. What should I check?

Start with the [Credentials] page in Google Cloud Console and confirm the OAuth 2.0 client still exists and its secret has not been deleted or replaced. Next, check the [OAuth consent screen] to confirm the app is not restricted. Google may also suspend a project over a billing issue or policy violation; check the [IAM & Admin] → [Settings] page for any project-level warnings.

Verification Checklist

Confirm each of the following after restarting Tymeslot:
  • A Google button appears on the sign-in page.
  • Clicking it opens Google's account picker, then returns to Tymeslot without an error.
  • Your Tymeslot account uses the name and verified email address from your Google account.
  • A Google Calendar connection option is visible under Dashboard → Integrations.
  • If using Meet: a Google Meet option is visible in the video section of the same page.

🔗 Related Articles

Read Microsoft Azure App Setup

Microsoft Azure App Setup

Register an Azure app for Tymeslot. Enables Outlook Calendar sync and Teams meetings. Covers API permissions and admin consent requirements.

Read Generic SSO (OAuth / OIDC)

Generic SSO (OAuth / OIDC)

Connect any OAuth 2.0 / OpenID Connect identity provider for single sign-on. Supports Keycloak, Authentik, Lemonldap::NG, Okta, Azure AD, and more.