Google login practical guide
Google login is a feature that lets users log in to the app with their own Google account. Google authenticates the user, and the app gets a Hive Axyl login session from the authentication result. Once the session is activated, the Hive Axyl SDK can identify the logged-in user.
To implement it, you must set up the Google external console, configure the Hive Console, install the Hive Axyl SDK and the login Add-on, call the recipe code, and write the app code, in that order. With the recipe, you can combine the calls from getting Google credentials to activating the Hive Axyl login session into one.
On Android, use the Credential Manager method, which provides the Google account selection screen. On iOS, macOS, and Windows, use the web login session method, which uses a browser.
Implementation scope
The work required to implement Google login starts with preparing credentials in the Google Cloud Console and ends with handling the login result in the app.
The work in each step falls into one of the following six categories.
| Category | Owner | Description |
|---|---|---|
| External console | App operator | Settings you configure in the Google Cloud Console. |
| Hive Console | App operator | Settings that enable Google login and register credentials in the Hive Console. |
| Hive Axyl SDK | App developer | The work of installing and initializing the authentication, token, and session modules, and the SDK methods used for login. |
| Add-on | App developer | Hive Axyl SDK extension packages that provide the Android account selection screen and the browser authentication session. |
| Recipe code | App developer | Source code that combines the calls from getting Google credentials to activating the session. |
| App code | App developer | Parts you implement directly: the login screen, credential source selection for each OS, storage of setting values, and screen handling for each result. |
This practical guide has no step that calls the Hive Axyl Server API directly. In the browser-based method, if you leave tokenEndpoint in WebAuthOptions empty, the recipe calls ExchangeProviderTokenAsync() of the Hive Axyl SDK. If you specify a value, the recipe communicates directly with Google's token endpoint. In both methods, the app does not call a Hive Axyl Server API endpoint directly.
Recipe
The Hive Axyl SDK provides getting Google credentials, exchanging external authorization codes, Hive Axyl login, token issuance, and session activation as separate calls. The recipe combines this sequence and runs it with a single LoginWithProviderAsync() call.
A recipe is plain C# source code that you copy into your project instead of installing as a package. Google login has an Android native method and a browser-based method, so copy only the credential sources for the methods your app supports.
| Category | Location | Characteristics |
|---|---|---|
| Hive Axyl SDK | Unity packages com.com2usplatform.hiveaxyl.* | You install and use it. It provides authentication features as fine-grained methods. |
| Common recipe | Assets/Recipes/ProviderLogin/ | Provides ProviderLoginRecipe, the result types, and the common code that uses credential sources. |
| Android recipe | Assets/Recipes/ProviderLogin.CredentialManager/ | Provides GoogleCredentialManagerCredentialSource. |
| Browser recipe | Assets/Recipes/ProviderLogin.WebAuth/ | Provides GoogleCredentialSource and the common web login session code. |
| Usage example | Assets/RecipeExamples/Authentication/ProviderLoginExample.cs | Code to read for reference. Its comments explain the login flow common to all external authentication providers and the parts the app must implement for each result. |
Google login provides two credential sources
GoogleCredentialManagerCredentialSource gets an id_token from Android Credential Manager, so it does not need an external authorization code exchange. GoogleCredentialSource processes the authorization code from the browser callback and then creates Google credentials. Select the source that fits the app's runtime environment and distribution policy, and pass it to ProviderLoginRecipe.
OSs supported by the recipe
For Google login, the way to get credentials differs by OS. Use the Credential Manager method on Android and the web login session method on the other supported OSs.
| OS | Authentication method | Credential source | Implementation method |
|---|---|---|---|
| Android | Android Credential Manager account selection screen | GoogleCredentialManagerCredentialSource | Follow the Android procedure in this guide. |
| iOS, macOS, Windows | Browser web login session | GoogleCredentialSource | Follow the browser procedure in this guide. |
To provide only the browser-based method on Android, you can use GoogleCredentialSource without installing the Credential Manager Add-on. In this case, you still need the WebAuth Add-on and the platform-specific redirect URI settings.
What the app implements
The recipe handles only the steps from getting credentials to activating the session. Implement the following items in the app.
- The login screen and the screen transition after login
- Selecting the Google credential source that fits the runtime environment
- Storing the Google OAuth client ID, authorization endpoint, Scope, and redirect URI
- Preparing the redirect URI for each OS in the browser-based method
- Creating and storing
DeviceKey - Storing the session tokens received from login
- Retries and user guidance based on the login result
The Web application type OAuth client ID used in the Android Credential Manager method and the provider client ID you put in WebAuthOptions.ClientId in the browser-based method can serve different purposes. They are also different from the ClientId of the Hive Axyl SDK, so do not mix these values.
Common prerequisites
Before you start implementing, prepare the following items.
| Item to prepare | Required | Category | Where to check |
|---|---|---|---|
| OAuth client in the Google Cloud Console | Required | External console | Check the Google login credentials |
| Create a project | Required | Hive Console | Create a project |
| Create an App ID | Required | Hive Console | Create an App ID |
| Register and enable Google login credentials | Required | Hive Console | Google login credentials, Login method types |
| Check the Client ID | Required | Hive Console | Get the security key |
| Connect the SDK to your Unity project | Required | Hive Axyl SDK | Connect the SDK to your Unity project |
In the Google Cloud Console, prepare a Web application type OAuth client to use for the browser exchange, and an Android type OAuth client that verifies the Android app's package name and signature. Pass the Web application type client ID to the Android Credential Manager recipe. Do not include the Client Secret in the app.
The App ID is used when you initialize the SDK, and the Hive Axyl Client ID is used when you create the recipe. The Google OAuth client ID is a separate value that you get from Google and pass to the credential source.
Next steps
If you have finished the prerequisites, start Implement Google login.