This feature requires the Team or Enterprise plan.
Prerequisites
Setup
1. Create OAuth Credentials
- Go to the Google Cloud Console
- Select or create a project
- Navigate to APIs & Services > Credentials
- Click Create Credentials > OAuth client ID
- If prompted, configure the OAuth consent screen first:
- Choose Internal to restrict sign-in to your Google Workspace organization only
- Choose External to allow any Google account to sign in
- Select Web application as the application type
- Add authorized redirect URI:
<<external_url>>/api/auth/google/callback
- Click Create
- Copy the Client ID and Client Secret
Add the Google provider to your pgconsole.toml:
[general]
external_url = "https://pgconsole.example.com"
[auth]
# openssl rand -hex 32
jwt_secret = "your-secret-key-at-least-32-characters-long"
signin_expiry = "7d"
[[auth.providers]]
type = "google"
client_id = "your-client-id.apps.googleusercontent.com"
client_secret = "your-client-secret"
# Google email is used as the user identifier in groups and IAM rules
[[groups]]
id = "dev-team"
name = "Development Team"
members = ["[email protected]", "[email protected]"]
[[iam]]
connection = "production"
permissions = ["read"]
members = ["user:[email protected]", "group:dev-team"]
3. Restart pgconsole
Restart the application for changes to take effect. A “Sign in with Google” button will appear on the login page.
