---
title: "Google Auth"
method: POST
path: "/api/auth/google"
tags: ["auth"]
---

# Google Auth

`POST /api/auth/google`

## Request

- Base URL: `https://api.stellara.natlex.it` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stellara.natlex.it/api/auth/google`
- Auth: none declared

Authenticate via Google Sign-In ID token (Android Web Client OR iOS Client).

The `aud` claim differs per platform:
  - Android sends a token issued for ``GOOGLE_CLIENT_ID`` (Web OAuth Client).
  - iOS sends a token issued for ``GOOGLE_IOS_CLIENT_ID`` (from
    ``GoogleService-Info.plist::CLIENT_ID``).

We verify the token WITHOUT passing ``audience=`` (the google library
would only accept a single value) and then assert the decoded ``aud`` is
in our allow-list. This keeps Android-only deploys backward-compatible:
when ``GOOGLE_IOS_CLIENT_ID`` is empty, the allow-list collapses to the
Web Client ID and behaviour is identical to the previous single-audience
check.

## Request body

- GoogleAuthRequest
  - `google_token` string, required

## Response `200`

Successful Response

- TokenResponse
  - `access_token` string, required
  - `refresh_token` string, required
  - `token_type` string
  - `is_new_user` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/natlex/apis/stellara-api.md) · [All operations](https://skmtc.dev/natlex/apis/stellara-api/llms.txt) · [OpenAPI document](https://skmtc.dev/natlex/apis/stellara-api/revisions/e576f046b61f?raw)