Google OAuth Setup

Use this guide when an SME, Educational Institute, or ISP wants WispHive to host the login entry URL on a WispHive auth domain while Google remains the identity provider.

Provider field mapping

Field	Google value
provider_name	google
oauth_authorize_url	https://accounts.google.com/o/oauth2/v2/auth
oauth_token_url	https://oauth2.googleapis.com/token
oauth_jwks_url	https://www.googleapis.com/oauth2/v3/certs
oauth_client_id	Your Google OAuth client ID
oauth_client_secret	Your Google OAuth client secret
oauth_scope	openid profile email
oauth_audience	Usually the same as the client ID

cURL

curl -X POST "https://auth.samwifi.site/api/v1/oauth/integrations/hosted" \
  -H "Content-Type: application/json" \
  -d '{
    "registration_id": "sme_1ab23cd45ef6",
    "entity_name": "Acme SME",
    "provider_name": "google",
    "oauth_authorize_url": "https://accounts.google.com/o/oauth2/v2/auth",
    "oauth_token_url": "https://oauth2.googleapis.com/token",
    "oauth_jwks_url": "https://www.googleapis.com/oauth2/v3/certs",
    "oauth_client_id": "1234567890-abc123.apps.googleusercontent.com",
    "oauth_client_secret": "replace-with-real-secret",
    "oauth_scope": "openid profile email",
    "oauth_audience": "1234567890-abc123.apps.googleusercontent.com"
  }'

Python

import requests

payload = {
    "registration_id": "sme_1ab23cd45ef6",
    "entity_name": "Acme SME",
    "provider_name": "google",
    "oauth_authorize_url": "https://accounts.google.com/o/oauth2/v2/auth",
    "oauth_token_url": "https://oauth2.googleapis.com/token",
    "oauth_jwks_url": "https://www.googleapis.com/oauth2/v3/certs",
    "oauth_client_id": "1234567890-abc123.apps.googleusercontent.com",
    "oauth_client_secret": "replace-with-real-secret",
    "oauth_scope": "openid profile email",
    "oauth_audience": "1234567890-abc123.apps.googleusercontent.com",
}

resp = requests.post("https://auth.samwifi.site/api/v1/oauth/integrations/hosted", json=payload, timeout=15)
resp.raise_for_status()
print(resp.json())

Google Cloud configuration

1. Create or open an OAuth 2.0 Web Application in Google Cloud Console.
2. Use the returned callback_url as an Authorized redirect URI.
3. Keep the hosted_login_url for your captive portal.
4. Do not expose the client secret in the browser.

Captive portal usage

Your captive portal should link users to the returned hosted_login_url, not directly to Google.