How to add Google Sign-In to an iOS app

What Google Sign-In does for an iOS app

Google Sign-In gives users a familiar one-tap login with an account they already have, which lifts sign-up rates compared with a new email and password. Your app presents Google's sign-in sheet, the user approves, and you receive an ID token and basic profile. You verify that token on your server to trust the identity. Because it is a third-party social login, offering it triggers the requirement to also offer Sign in with Apple or an equivalent.

Adding it with AppFlight, and manually

In AppFlight you ask for Google sign-in, and the AI adds the SDK, the URL scheme, and the flow that hands the ID token to your backend. If you connect Supabase, AppFlight passes the token to Supabase auth so the user is verified server-side, and it keeps any backend secret out of the app. AppFlight stores the iOS client ID as a client value, which is safe to ship.

Manually, you create an iOS OAuth client in the Google Cloud console, add the reversed client ID to your URL types, add the GoogleSignIn package, call signIn from your root view controller, and send the result's idToken to your server for verification.

A SwiftUI example

Present the sign-in and read the ID token:

import GoogleSignIn
import SwiftUI

struct GoogleSignInView: View {
    var body: some View {
        Button("Sign in with Google") {
            guard let root = UIApplication.shared.connectedScenes
                .compactMap({ ($0 as? UIWindowScene)?.keyWindow?.rootViewController })
                .first else { return }
            GIDSignIn.sharedInstance.signIn(withPresenting: root) { result, error in
                guard let token = result?.user.idToken?.tokenString else { return }
                // Send token to your backend to verify and create the user.
                print("idToken: \(token)")
            }
        }
    }
}

Common pitfalls

Forgetting the reversed client ID URL scheme is the most common failure, since the sign-in sheet cannot return without it. Trusting the profile data from the SDK without verifying the ID token server-side leaves you open to spoofed sign-ins. Adding Google but not Sign in with Apple risks a guideline 4.8 rejection. Hardcoding any value that looks like a secret is unnecessary here, since the iOS client has no secret, but a web or server client secret must never reach the app.