Google

Create a Google Application

• Visit: Google Cloud Console and open the Console

• Create a New Project and give it a name

Google Application Configuration

• Select the project you just created and go to APIs and Services

• Select Credentials and click CONFIGURE CONSENT SCREEN

• Select External then click CREATE

• Fill in your App information

Note: You can get a logo from your LibreChat folder here: docs\assets\favicon_package\android-chrome-192x192.png

• Configure your App domain and add your Developer contact information then click SAVE AND CONTINUE

• Configure the Sopes
  • Add email,profile and openid
  • Click UPDATE and SAVE AND CONTINUE

• Click SAVE AND CONTINUE

• Review your app and go back to dashboard

• Go back to the Credentials tab, click on + CREATE CREDENTIALS and select OAuth client ID

• Select Web application and give it a name

• Configure the Authorized JavaScript origins, you can add both your domain and localhost if you desire
  • Example for localhost: http://localhost:3080
  • Example for a domain: https://example.com

• Add a valid Authorized redirect URIs
  • Example for localhost: http://localhost:3080/oauth/google/callback
  • Example for a domain: https://example.com/oauth/google/callback
  • If using the Admin Panel: https://example.com/api/admin/oauth/google/callback

.env Configuration

• Click CREATE and copy your Client ID and Client secret

• Add them to your .env file:

DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain

GOOGLE_CLIENT_ID=your_client_id
GOOGLE_CLIENT_SECRET=your_client_secret
GOOGLE_CALLBACK_URL=/oauth/google/callback

• Save the .env file

Note: If using docker, run docker compose up -d to apply the .env configuration changes

Admin Panel Sessions

The Admin Panel uses the same GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, but its callback is ${DOMAIN_SERVER}/api/admin/oauth/google/callback. Its Google flow requests offline access and consent so an expired LibreChat admin token can be refreshed. LibreChat rechecks the user's identity, ban state, allowed domain, tenant, and current admin access on every refresh.