OAuth providers

Configure provider credentials for federated sign-in. Stored on disk at secrets/oauth/<provider>.json (mode 0600), not in the database.

Google Configured

redirect_uri: https://id.prx.is/callback/google
Register this exact URL with Google. Route variants (for example, /auth/callback/<provider>) are also valid if registered.
client_id: 1046020591521-o3g0afghoum0l1grddiphrsv026ushmg.apps.googleusercontent.com
updated: 2026-05-10T03:20:09.706Z

redirect_uri: https://id.prx.is/callback/microsoft
Register this exact URL with Microsoft. Route variants (for example, /auth/callback/<provider>) are also valid if registered.
client_id: a286b5fc-d945-4d3d-946b-b68f5f4c4507
updated: 2026-05-10T03:20:09.707Z

Lands in M7. Apple uses ES256 client-secret signing rather than a static client_secret, so the form is different.

Google — Cloud Console → APIs & Services → Credentials → OAuth 2.0 Client IDs. Add the redirect_uri above to "Authorized redirect URIs".
For Google paths behind a base mount point (for example https://host/auth/callback/google), register that full URL too.
Microsoft — Entra admin → App registrations → your app → Authentication → Web → Redirect URIs. Add the redirect_uri above. Set the supported account types (multi-tenant for common; single-tenant requires the specific tenant_id here).