---
title: "Start Google OAuth flow"
method: POST
path: "/auth/v1/oauth/google/start"
tags: ["Auth"]
---

# Start Google OAuth flow

`POST /auth/v1/oauth/google/start`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/oauth/google/start`
- Auth: API key in header `apikey`

Initiates Google OAuth for app end-users. Returns an authorization_url to open in a popup or redirect. After Google auth, the callback delivers a one-time code to your redirect_url, which you exchange via POST /auth/v1/token?grant_type=authorization_code.

## Request body

- object
  - `redirect_url` string, required: Where to send the auth code after Google login. Must be http://localhost:* or a added subdomain (https://{name}.run402.com).
  - `mode` 'redirect' | 'popup': Redirect mode (default) navigates the full page. Popup mode opens a window but window.close() may be blocked by browser COOP policies.
  - `intent` 'signin' | 'link'
  - `code_challenge` string: PKCE code challenge (base64url of SHA-256 of verifier)
  - `code_challenge_method` 'S256'
  - `client_state` string: Opaque state passed back to your redirect_url
  - `login_hint` string: Email hint for Google account picker

## Response `200`

Authorization URL to open in browser

- object
  - `provider` string
  - `authorization_url` string, uri
  - `expires_in` integer

## Other responses

- `400`: Bad request
- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)