Vertex — Google sign-in
Vertex uses a server-side OAuth 2.0 flow (scopes openid email profile) implemented in the identity
service. The callback path is /auth/google/callback, reached through the Worker on the console hostname.
One Google Cloud project per environment
The Internal/External user type is set per project, so stage and prod use separate projects and separate OAuth clients. The prod client secret never reaches stage.
| prod | stage | |
|---|---|---|
| Project | vertex-prod | vertex-stage |
| Client type | Web application | Web application |
| Redirect URI | https://<subdomain>.thetaxgraph.com/auth/google/callback | https://stage-<subdomain>.thetaxgraph.com/auth/google/callback |
| Audience | Internal (Workspace accounts only) — or External + brand verification if non-TTG accounts must sign in | External, publishing status Testing |
| Who can sign in | TTG Workspace users, then the app's invite list | Listed test users (≤ 100, e.g. vendor Gmail accounts), then the app's invite list |
| Google verification | Not needed for Internal; brand verification for External | Not needed |
App settings (in vertex-<env>/app)
| Key | Value |
|---|---|
GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET | From the env's OAuth client |
GOOGLE_REDIRECT_URI | The env's redirect URI (exact match) |
CONSOLE_BASE_URL | https://<env hostname> (also enables Secure cookies) |
ALLOWED_EMAIL_DOMAINS | prod: TTG login domain · stage: empty or including the vendor domain |
What Google requires (checked 2026-09-24)
- Apps using only non-sensitive scopes do not need full app verification.
- Authentication-only apps must submit for brand verification; without it, only the app domain is shown on the consent screen (no app name/logo).
- Brand verification needs a public home page with a privacy policy link and the domain verified in Google Search Console.
- Testing status: up to 100 test users, an "unverified app" warning before consent, authorizations expire after 7 days; verification is not required.
Sources: OAuth app verification help · Brand verification policy · Manage OAuth app branding · Manage app audience · When verification is not needed