Google sign-in

Read the sign-in decision record in docs/decisions. Add Sign in with Google. On a hosted provider, turn on its Google connection with this product's own OAuth client and check that its account linking follows the rule below. In your own service, use a maintained library for the OIDC authorization code flow with PKCE, keep the state, nonce and verifier in a short-lived __Host- cookie and check them on return. Set up the consent screen with the product's name, add the button to the login and sign-up pages following Google's branding rules and store the identity by provider and subject, never by address. Link to an existing user only when Google reports the address verified and the existing identity is verified too. Otherwise ask the user to sign in first and link from settings, because linking on an unverified address is an account takeover. Test both cases. Google refuses sign-in inside the built-in browsers of apps such as LinkedIn or Instagram, so detect them and offer to open the page in the real browser. Then try it with a real account.