Setup Google Auth - NowStack Mobile

<read_first> Read the auth feature flag and the real provider implementation before changing anything:

rg -n "enableGoogleSignIn|GOOGLE_CLIENT|google|getEnabledAuthProviders|CONVEX_SITE" \
  site-config.ts convex mobile-app web-app scripts
npx convex env list | sed 's/=.*$/=<set>/'
npx convex run auth:getEnabledAuthProviders '{}'

For --prod, also run:

npx convex env list --prod | sed 's/=.*$/=<set>/'
npx convex run --prod auth:getEnabledAuthProviders '{}'

Derive {convex_site_host} from the target deployment's .convex.site URL. The callback is always:

https://{convex_site_host}/api/auth/callback/google

</read_first>

# development
npx convex env set SITE_URL "http://localhost:3111"
npx convex env set GOOGLE_CLIENT_ID "<client>.apps.googleusercontent.com"
pbpaste | npx convex env set GOOGLE_CLIENT_SECRET

# production (--prod)
npx convex env set --prod SITE_URL "https://<production-app-domain>"
npx convex env set --prod GOOGLE_CLIENT_ID "<production-client>.apps.googleusercontent.com"
pbpaste | npx convex env set --prod GOOGLE_CLIENT_SECRET

On non-macOS systems, use the platform clipboard equivalent or pipe a protected runtime variable to the same value-less convex env set command. Never put the secret literal in the command line.

8. Do not write these values to .env, .env.local, site-config.ts, docs, shell history, or build config.

# development
npx convex run auth:getEnabledAuthProviders '{}'

# production
npx convex run --prod auth:getEnabledAuthProviders '{}'

The result must report google: true. Then:

1. Open the signed-out web sign-in route with the repo's browser-verification workflow.
2. Confirm the Google button is visible.
3. Click it and confirm the redirect reaches accounts.google.com, uses the expected client ID, and carries the exact target Convex callback.
4. On mobile, reload the Expo app against the same target Convex deployment and confirm the Google button appears. Exercise the redirect/deep-link return when the environment supports it.

If the button is absent, check the feature flag, target deployment, both Convex env values, and query result before changing UI code.

<production_invariant> A production deployment is blocked until a production-specific Google OAuth client exists, its production callback is registered, its fresh client secret is stored with --prod, and the production provider query returns google: true. Development credentials are not a production shortcut. </production_invariant>

<success_criteria>

• Correct deployment-specific callback registered in Google Cloud.
• Client ID and secret exist only in the matching Convex environment.
• Provider query reports Google enabled on the target deployment.
• Web redirect and mobile provider visibility are verified.
• Production never reuses the development OAuth client secret. </success_criteria>