Free tools Windows power users keep installed
One-click scans. No signup required.
To take a working React Google OAuth flow to production, use a separate Google Cloud project and web OAuth client for production, keep the client secret on a backend, and register only the production HTTPS origins and redirect URIs. First decide whether the app needs sign-in alone or permission to call Google APIs: those needs use different authorization patterns.
Choose the flow for what your app needs
Signing a user in and authorizing your app to call Google APIs are related but distinct tasks. For authentication-only needs such as openid, email, and profile, assess whether Sign in with Google and an ID token meet your requirements. If the app needs Google API access, use Google Identity Services (GIS) for browser authorization and choose a flow that fits the backend responsibilities.
As an Amazon Associate I earn from qualifying purchases.
For Google API access, prefer the authorization-code model
Google recommends the authorization-code flow because it provides a more secure flow. In this model, the browser obtains a short-lived authorization code, and a backend exchanges that code with Google for tokens. Google’s comparison says this model uses client authentication and avoids in-browser token-handling risks. It is also the appropriate model when offline access and refresh tokens are needed, because the backend can store those credentials securely.
The implicit model returns access tokens to browser code. It is browser-only and requires the user to be present for token requests, so it is not Google’s preferred production default. See Google’s authorization-model comparison and overview of user authorization.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose popup or redirect code delivery
With popup UX, the GIS browser callback receives the code and sends it to your backend. With redirect UX, Google sends the code to a backend authorization endpoint. In either case, the backend must validate the request and exchange the code at Google’s token endpoint. Google describes popup code flow as a usability and security balance; the important production boundary is that code exchange and confidential credentials remain server-side. Follow Google’s code-model guidance.
Separate production configuration from development
Create a production Google Cloud project and web OAuth client rather than promoting a client that also contains local or pre-release settings. Google recommends separate test and production projects, and says production clients should not include test servers or pre-release environments. The production client should list only the origins and redirect URIs the live app uses.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Register production JavaScript origins and redirect URIs using HTTPS. Google documents localhost exceptions for development, not a reason to use insecure production URLs.
- Use domains your app owns or is authorized to use.
- Make every redirect URI match the registered value exactly, including scheme, capitalization, path, and trailing slash.
- Keep localhost, staging, and other test endpoints out of the production client.
Google’s OAuth policies, web-server flow documentation, and production-readiness guidance describe these requirements and exceptions.
Recommended Free Tools
Keep the client secret and token exchange on the backend
The client ID identifies the configured browser application; it is not the confidential credential. The client secret must never be placed in a React bundle, a frontend environment variable that gets compiled into the bundle, or a public source repository. Anything delivered to a browser can be inspected by its user.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Store the secret where only the application backend can access it; Google names Secret Manager as one example. The backend should perform code exchange and, if offline access is needed, store refresh tokens securely. The browser may initiate the authorization interaction, but it should not receive the web client secret or take on server-side token-storage responsibilities. See Google’s OAuth best practices and GIS overview.
Request only the permissions your features need
Ask for the minimum scopes required by the app, and prefer requesting them when a user tries to use the feature that needs them. Contextual, incremental authorization avoids asking every user for permissions they may never need.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not assume consent to every requested scope. If a user grants only some scopes, disable the feature that lacks permission and explain what access it needs. Request the missing scope again only when the user indicates they want that feature. Handle denial or revocation without breaking unrelated parts of the app. Google’s OAuth policies cover scope expectations, and the GIS JavaScript API reference documents browser API behavior.
Prepare the app for Google’s production checks
Google’s production-readiness guidance calls for a publicly accessible homepage on a verified domain you own. The page should describe what the app does and link to its privacy policy and terms of service. Review the production-readiness checklist before launching.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Some sensitive or restricted scopes can trigger additional verification requirements. The exact requirements depend on the scopes and APIs selected; do not assume that a particular configuration will be approved without checking Google’s current guidance. Google’s OAuth policies explain the scope-related requirements.
Quick Recap
Production launch checklist
- Create a distinct production Cloud project and web OAuth client.
- Remove development and pre-release origins and redirect URIs from the production client; confirm the live HTTPS values match exactly.
- Keep the client secret in backend-only secure storage, and route authorization-code exchange through the backend.
- Request only the scopes needed for the feature in use; handle partial consent, denied access, and revoked or expired credentials.
- Publish a homepage on a verified owned domain with an app description, privacy policy, and terms of service.
- Check current Google documentation and Cloud Console settings before launch, since policy and verification requirements can change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
