---
title: "Sign in with Google"
method: POST
path: "/v1/auth/google"
tags: ["Auth"]
---

# Sign in with Google

`POST /v1/auth/google`

## Request

- Base URL: `https://api.naturali.ai`
- URL: `https://api.naturali.ai/v1/auth/google`
- Auth: none required

Exchanges a Google ID token, issued to this deployment's web client, for a session. The account is the one for the token's address: an address that signed in with an emailed code reaches the same account, and a new address gets one. Google must have verified the address.

## Request body

- GoogleSignIn
  - `id_token` string, required: The `credential` Google Identity Services returns to the page.

## Response `200`

Authenticated; a session is returned.

- AuthSession: A short-lived access JWT plus a rotating refresh token. The refresh token is also set as an httpOnly, SameSite=Lax cookie scoped to `/v1/auth` (Secure whenever the connection is https), which is what carries a browser session across a reload; the body copy is for clients with no cookie jar, such as the CLI.
  - `token_type` 'Bearer', required
  - `access_token` string, required: Short-lived access JWT. Send as `Authorization: Bearer <token>`.
  - `expires_in` integer, required: Access-token lifetime in seconds.
  - `refresh_token` string: Single-use refresh token, rotated on every refresh.
  - `user` User, required
    - `id` string, required: Public user ID (user_ prefix).
    - `email` string, email, required
    - `name` string, nullable
    - `email_verified` boolean, required
    - `roles` string[], required: Roles on naturali itself, not on a project. Empty for almost every account; `admin` marks a naturali operator. Changed only through `PUT /v1/admin/users/{user_id}/roles`, by a caller holding the role that grants each one.
    - `usage_alerts` boolean, required: Whether the account is emailed when its model credit, runs or indexed storage reaches 75%, 90% and 100%. On for a new account.
    - `created_at` string, date-time, required

## Other responses

- `400`: The request was malformed or failed validation.
- `401`: The token is malformed, expired, not signed by Google or issued to another client (`invalid_token`).
- `403`: Google has not verified the address (`email_not_verified`).
- `503`: Sign-in with Google is not configured on this deployment (`google_sign_in_not_configured`).

---

[API](https://skmtc.dev/naturali/apis/naturali-ai-api.md) · [All operations](https://skmtc.dev/naturali/apis/naturali-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/naturali/apis/naturali-ai-api/revisions/e4905b78f422?raw)