Herald
OpenapiOauth

Google One Tap login.

Verifies a Google One Tap (GIS) ID Token server-side and, depending on `downstreamState`, issues either a direct browser session (Bearer token family bound to `clientId`) or a downstream authorization code for the Code+PKCE flow. Requires the realm to have an enabled Google provider.

POST
/api/oauth/{realmId}/google/one-tap

Verifies a Google One Tap (GIS) ID Token server-side and, depending on downstreamState, issues either a direct browser session (Bearer token family bound to clientId) or a downstream authorization code for the Code+PKCE flow. Requires the realm to have an enabled Google provider.

Path Parameters

realmId*string

Realm ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

clientId*string

Herald ClientApp client_id that the direct-session token family binds to.

credential*string

Google One Tap issued ID Token (JWT), from the GIS credential callback.

downstreamState?|

Optional downstream authorization transaction identifier (OAuth state). Presence selects the downstream-authorization-code branch; absence the direct-session branch.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/oauth/string/google/one-tap" \  -H "Content-Type: application/json" \  -d '{    "clientId": "string",    "credential": "string"  }'
{  "redirectUri": "string"}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}