How to Get Google App Client ID and Client Secret

Oct 20, 2026 Kiran Beladiya

To connect any application to Google services whether you are building a Google Sign-In feature, integrating Google Analytics, or accessing Google Drive or the YouTube API you need two credentials from the Google Cloud Console: a Client ID and a Client Secret.

These credentials are the foundation of Google OAuth 2.0 authentication. They allow your application to securely identify itself to Google and request permission on behalf of users without ever exposing user passwords.

This guide walks you through every step of the process: creating a project, enabling the right APIs, configuring the OAuth consent screen, generating your credentials, and handling the common errors that trip most developers up along the way.

If you need expert help integrating Google APIs into your web application, you can hire an ASP.NET developer or hire PHP developer from us at an affordable rate.

What Are Google Client ID and Client Secret?

Before diving into the steps, here is a quick overview of what these two credentials actually are and why both are needed:

Credential	What It Is	How It Is Used
Client ID	A public identifier for your application	Tells Google which app is making the request. Safe to use in client-side code.
Client Secret	A private key that verifies your app's identity	Confirms to Google that the request is coming from your app. Must be kept server-side and never exposed publicly.

Together, they power the OAuth 2.0 authorization flow the industry-standard protocol Google uses to grant applications access to user data securely. Without both credentials correctly configured, your application cannot authenticate with any Google API.

Before You Begin

Make sure you have the following ready before starting:

A Google account with access to the Google Cloud Console
The base URL of your website or application (e.g., https://theonetechnologies.com)
The redirect URI the URL in your application where Google should send users after they log in

How to Get Google App Client ID and Client Secret (Step-by-Step)

Follow the steps below to generate your Google App Client ID and Client Secret from the Google Cloud Console.

Step 1: Log In to Google Developer Console

Step 2: Accept the Terms of Service Agreement

If you are new to the Google Developer Console, you will need to accept the terms of service agreement before proceeding.

Step 3: Select a Project

After accepting the agreement, or if you are already registered, you will see the Google Cloud Console dashboard. Click "Select a project" on the top header bar.

Step 4: Create a New Project

Click the "NEW PROJECT" button in the project selection popup to create a new project.

Step 5: Name Your Project and Create It

Enter your Project name and click the "Create" button. You can also edit the Project ID if needed.

Step 6: Enable the Required Google APIs

This step is essential and often missed. Before generating credentials, you need to enable the specific Google APIs your application will use.

From the left side menu, navigate to APIs & Services > Library. Use the search box to find and enable the APIs relevant to your use case, then click Enable for each one.

Here are the most commonly required APIs:

API	When to Enable It
Google Analytics API	Google Analytics data access
Google Analytics Reporting API	Historical report data
Google People API	Google Sign-In and user profile access
Google Drive API	Google Drive file integration
YouTube Data API	YouTube content and channel integration
Google Search Console API	Search query data and impressions

Why this matters: Without enabling the relevant API, your credentials will not have the permissions needed to make API calls even if the Client ID and Secret are correctly set up.

Step 7: Open the OAuth Consent Screen

Navigate to APIs & Services > OAuth consent screen from the left side menu.

Step 8: Choose User Type and Create

On the OAuth consent screen, select a User Type based on your requirement:

Internal Only available for Google Workspace accounts. Restricts login access to users within your organization.
External Available to any Google account. Use this for public-facing websites and applications.

Click the Create button to proceed.

Step 9: Fill In Your App Information

Complete the required fields on the OAuth consent screen:

Application name The name users will see when asked to grant your app permissions
Support email A contact email for users who have questions about the login flow
Authorized domain Your website's root domain (e.g., theonetechnologies.com)
Developer Contact Information Email address(es) for Google to contact you about your project

Then click Save and Continue.

Important: If you leave the App domain fields (homepage URL, privacy policy link, terms of service link) empty, users will see a "This app isn't verified" warning when logging in. See the Troubleshooting section below for how to resolve this.

Step 10: Complete the OAuth Consent Screen Setup

After completing all three stages of the OAuth consent screen App Information, Scopes, and Test Users click Back to Dashboard on the Summary step.

You do not need to change anything on the Scopes or Test Users pages. Simply click Save and Continue on each to move forward.

Step 11: Publish Your App

On the OAuth consent screen dashboard, click the "Publish App" button. When the confirmation popup appears, click Confirm.

Why this step matters: Without publishing, your app stays in Testing mode. In Testing mode, only accounts you have manually added as test users can authenticate. Publishing makes your app available to all Google account users which is required for a live website or application.

Step 12: Go to Credentials and Create OAuth Client ID

From the left side menu, click "Credentials" to open the Credentials screen. Click "Create credentials" and select OAuth client ID from the dropdown menu.

Step 13: Configure the OAuth Client ID

On the Create OAuth Client ID screen, fill in the following:

Application Type Select Web Application from the dropdown
Name Enter a name for your OAuth 2.0 client. This is for internal reference only and will not be shown to users during login
Authorized JavaScript origins Enter your website's base URL (e.g., http://theonetechnologies.com)
Authorized redirect URIs Enter the full URL where Google should redirect users after login. If you are using the Microsoft.Owin.Security.Google library, the endpoint is /signin-google. For example: http://theonetechnologies.com/signin-google

Click the Create button.

Important: The redirect URI you enter here must exactly match the one used in your application code including http vs https, trailing slashes, and the full path. Even a minor difference will cause a redirect_uri_mismatch error.

Step 14: Copy Your Client ID and Client Secret

A popup will appear displaying your Client ID and Client Secret. Copy both values immediately and store them in a safe, secure location.

You have now successfully generated your Google App Client ID and Client Secret.

Troubleshooting Common Errors

Even with the correct steps, a few errors are frequently encountered when setting up Google OAuth 2.0 credentials. Here is how to identify and fix each one.

Error 400: redirect_uri_mismatch

This is the most common error developers run into after setting up OAuth credentials.

What causes it: The redirect URI your application sends to Google does not exactly match any of the Authorized Redirect URIs registered in the Google Cloud Console.

How to fix it:

Go to your OAuth 2.0 Client ID in the Google Cloud Console
Under Authorized redirect URIs, verify that the URI matches your application exactly including the protocol (http vs https), any trailing slashes, and the full path
Save the changes and wait a few minutes for Google's configuration to update
Copy the URI directly from your application logs rather than typing it manually this eliminates the risk of typos

"This App Isn't Verified" Warning

Users may see this warning when logging in through your application. It appears when the App domain fields on the OAuth consent screen are left incomplete.

To continue using the app without verifying:

Click Advanced on the warning screen
Click Go to [your domain] (unsafe)
Click Allow when prompted

This approach is acceptable during development. For a live production application, proceed with verification below.

To remove the warning permanently:

Go to APIs & Services > OAuth consent screen
Click Edit App
Under App domain, fill in:
Application home page URL
Privacy policy link
Terms of service link
Click Save and Continue through all steps and return to Dashboard
Submit for Google verification

Note: After submitting, Google's Trust and Quality team will email you to verify property ownership via Google Search Console. Verification typically takes a few days.

invalid_client Error

What causes it: The Client ID or Client Secret in your application code does not match what is stored in the Google Cloud Console.

How to fix it: Return to your OAuth 2.0 Client ID in the console and re-copy the credentials carefully, checking for missing characters or extra spaces.

403 Forbidden After Authentication

What causes it: Your application is trying to access a Google API that has not been enabled for your project.

How to fix it: Go to APIs & Services > Library and enable the specific API your application is requesting. Refer to the table in Step 6 for the most common APIs.

Security Best Practices for Your Client ID and Client Secret

Once you have your credentials, handling them correctly is just as important as generating them. Here are the key security practices to follow:

Never hardcode credentials in your source code. If your repository is ever made public even accidentally exposed credentials can be misused immediately.
Use environment variables to store your Client Secret in your application. This keeps sensitive values out of your codebase entirely.
Do not store secrets in configuration files that are committed to version control. Use a dedicated secrets manager such as Google Cloud Secret Manager for production applications.
Keep your Client Secret server-side at all times. Unlike the Client ID, which can appear in client-side code, the Client Secret must never be sent to a browser or included in front-end files.
Rotate your Client Secret periodically. Google Cloud Console supports secret rotation you can generate a new secret, update your application to use it while the old one is still active, and then revoke the old secret with zero downtime.
Create separate credentials for each environment. Use distinct Client IDs for development, staging, and production. This limits the impact if one set of credentials is ever compromised.
Delete OAuth clients you no longer use. Unused credentials are an unnecessary security risk. Remove them from the Google Cloud Console when they are no longer needed.

Frequently Asked Questions

What is a Google App Client ID and Client Secret?

A Google App Client ID and Client Secret are OAuth 2.0 credentials that identify and verify your application when it connects to Google APIs. The Client ID is your app's public identifier, while the Client Secret is a private key that must be kept secure at all times.

Is it okay to use the same Client ID and Secret for multiple applications?

No. Each application should have its own unique Client ID and Client Secret. Sharing credentials across apps creates security risks and makes it impossible to revoke access for one app without affecting the others.

Where should I store my Client ID and Client Secret?

Store your Client Secret in environment variables or a dedicated secrets manager never in source code or configuration files that are committed to a repository. The Client ID can be used in client-side code, but the Client Secret must remain server-side only.

How can I get a Google App Client ID and Client Secret?

Log in to the Google Cloud Console, create a new project, enable the required APIs, set up the OAuth consent screen, publish your app, and create an OAuth Client ID credential. Your Client ID and Client Secret will be displayed in a popup after the credential is created.

Why do I need a Google App Client ID and Client Secret?

These credentials are required to integrate your application with Google services such as Google Sign-In, Gmail, Google Drive, Google Analytics, or the YouTube API. Without them, your app cannot authenticate with Google or request access to user data.

Can I change or regenerate my Google App Client ID or Client Secret later?

Your Client Secret can be regenerated at any time from the Google Cloud Console this is useful if a secret has been exposed or for routine security maintenance. The Client ID, however, remains fixed for the lifetime of the OAuth client. If you need a new Client ID, create a new OAuth client entirely.

Conclusion

Getting your Google App Client ID and Client Secret is a straightforward process once you know every step from enabling the right APIs and publishing your app to configuring redirect URIs and securing your credentials. Following the steps in this guide, you can complete the full setup in under 15 minutes and have your application connected to any Google service.

If you run into issues or would prefer to have the entire Google API integration handled professionally, you can always reach out to a trusted software outsourcing company in India for a quick and cost-effective solution.

Social Media API Integration