Form: sign in and register with Google

How to use it

1. In Bricks > Kiln, turn on Form: sign in with Google and copy the Authorized redirect URI it shows.
2. In Google Cloud > APIs & Services:
   • Set up the OAuth consent screen with your site's name, and publish it when you go live.
   • Under Credentials, create an OAuth client ID of type Web application. Paste the redirect URI under Authorized redirect URIs.
3. Paste the Client ID and Client secret into Bricks > Kiln and save.
4. Select a Form element whose actions include Login or Registration. Open its Google sign-in (Kiln) group and tick Show "Continue with Google" button. Then choose:
   • Text: Continue with Google, Sign in with Google or Sign up with Google.
   • Theme: Light, Dark or Neutral, Google's three button styles.
   • Position: Above the fields or Below the submit button.

To use a button of your own, link it to {kiln_google_login_url}. After signing in, the visitor returns to the page the link was on.

Which account a Google sign-in opens

1. The account already linked to that Google account.

2. Otherwise, an account with the same email, if Google vouches for that address: a Gmail address, or one on the Google Workspace domain the account belongs to. Google checked any other address only once, when the account was made, so such an account links from its profile first. By default this only applies to customers and subscribers. Administrators, editors and every other role link Google from their own profile first (Users > Profile > Link Google account). Without that step, someone who controls an email address could take over an administrator account. An account that can edit posts or manage the shop, options or users always links first, even if a developer widens the roles.

   The first time an email match opens an account, Kiln replaces its password and signs out its other sessions. Someone may have registered that address with a password of their own before its owner arrived; this locks them out. The owner can set a new password with Lost your password? whenever they like.

   A password reset removes a Google link made for an address Google doesn't vouch for. Reset proves who holds the email now, so that Google account stops working; the owner links again from their profile.

3. Otherwise, a new account, for a Gmail or Google Workspace address only (other addresses register the usual way), and only when the site accepts registrations: WordPress' Anyone can register (Settings > General) or WooCommerce's registration on the My account page. WooCommerce creates a customer. WordPress uses the default role, unless that role can manage options or users; then Kiln creates no account.

If none of these applies, the visitor returns to the form with one message: "Google sign-in did not work. If you already have an account, sign in with your password, then link Google from your profile." The message never says whether an account exists.

Where it appears in Bricks

• Form, Content tab: the group Google sign-in (Kiln). It shows when the form's actions include Login or Registration.
• Dynamic data picker: {kiln_google_login_url}, in the Kiln group, labelled "Google sign-in link".
• Users > Profile: a Google sign-in section to link or unlink the account.

How it works with Bricks

• After signing in, the visitor goes to the form's Redirect action URL when it has one. Otherwise they go to the redirect_to address in the page URL, as with Bricks' own login action, or back to the page. WordPress' login_redirect filter runs last, so login redirect rules from Kiln or WooCommerce apply. Kiln ignores addresses on other sites.
• The sign-in runs on your site's login address (wp-login.php?action=kiln_google). A plugin that moves the login page through WordPress' site_url filter moves this address too; copy the redirect URI again after installing one. It also works when Bricks > Settings hides the WordPress login page (WordPress auth URL behavior).
• Kiln uses Google's authorization code flow with PKCE. The exchange with Google happens on your server, and the client secret never reaches the browser. A sign-in completes only in the browser that started it, within 10 minutes, and only once.
• A Google sign-in passes the checks a password sign-in does: WordPress' authenticate and wp_authenticate_user filters, then wp_login. Approval, blocking and two-factor plugins hooked there can refuse it, and Bricks' user activation holds back accounts that are not activated yet. Accounts Kiln creates count as activated, because Google has verified the email.

Limits

• One Google account links to one site account. Unlinking is on the profile page.
• Kiln does not sync profile photos or other Google data. New accounts get the name and email from Google.
• The button follows Google's branding rules, so its text and colors are fixed to Google's three styles. For a custom design, use your own button with {kiln_google_login_url}.
• While the consent screen is in Testing, only the test users listed in Google Cloud can sign in.
• If a customer's company domain lapses and someone else registers it, that person can create a Google account for the old address and open the customer's account. To turn email matching off, return an empty list from kiln/google_sign_in/email_match_roles; customers then link Google from their profile.

Settings

Bricks > Kiln > Form: sign in with Google:

• Authorized redirect URI: read-only. Copy it into Google Cloud.
• Client ID and Client secret: Kiln keeps the secret on your server and never prints it. Paste a new one to replace it, or tick Remove when I save.
• Existing accounts with the same email: customers and subscribers (the default) or any role, administrators included. With any role, whoever controls an administrator's email address can sign in as that administrator, so keep the default unless every admin address is on a domain you control. A network super admin always links first.
• New visitors: create an account when the site accepts registrations (the default), or never.
• The last failed sign-in and its reason show under the settings, to help you set up the Google client.

For developers: kiln/google_sign_in/email_match_roles changes the roles an email may open, and kiln/google_sign_in/redirect_uri changes the redirect URI sent to Google.

Requirements

Bricks 2.4 or newer and a Google Cloud OAuth client. WooCommerce is optional.