Skip to content

Under developmentMica is experimental and not ready for production. The API and the content format can still change, so read the release notes before you upgrade.Follow the releases.

Docs/Sign in with Google

Operate

Sign in with Google

Let editors sign in to a self-hosted Mica with a Google account: the Google Cloud setup, the .env values, and the first sign-in.

12 min read

This page sets up sign-in with Google for a self-hosted Mica. It is the shortest path for most teams. You need the files and the repository token from Self-hosting, steps 1 and 2. Run the check from "Before the first start" on that page too.

Google gives Mica the address of the person. Mica checks that address against your list. Google sends no groups claim, so you use MICA_ADMIT_EMAILS. For a Google Workspace organisation you can use MICA_ADMIT_DOMAINS with your domain.

Before you start

  • Your Mica address with HTTPS, for example https://cms.example.com. Google requires HTTPS redirect URIs, except for localhost.
  • A Google account that can open the Google Cloud Console.
  • The addresses of the people who may edit.

1. Set up the consent screen

  1. Open the Google Cloud Console and select or create a project.
  2. Open the OAuth consent screen.
  3. Choose the user type. Choose Internal for a Google Workspace organisation, so that only its members can sign in. Otherwise choose External.
  4. Fill in the app name and the support email.

Google shows the screens with pictures in its own guide: Setting up OAuth 2.0.

2. Create the client

  1. Create an OAuth client ID.
  2. Choose the application type Web application.
  3. Add this authorized redirect URI. Use your own host.
https://cms.example.com/api/auth/callback
  1. Create the client. Copy the client ID and the client secret.

3. Fill in .env

MICA_OIDC_ISSUER=https://accounts.google.com
MICA_OIDC_CLIENT_ID=<the client ID from Google>
MICA_OIDC_CLIENT_SECRET=<the client secret from Google>
MICA_PUBLIC_URL=https://cms.example.com

Now say who may edit. For named people, use the email list:

MICA_ADMIT_EMAILS=alice@gmail.com,bob@example.com

For a Google Workspace organisation, use the domain instead:

MICA_ADMIT_DOMAINS=example.com

Mica refuses MICA_ADMIT_DOMAINS=gmail.com at start-up, because it would admit the public. Mica accepts only addresses that Google reports as verified.

With Google, the domain rule also needs the Workspace domain of the account: the hd claim, which Google sends for an account of a Workspace organisation. Google also reports a personal Google account with an address at your domain as verified, for example an account that a former employee keeps. That account has no hd, so the domain rule does not admit it. Put the primary domain of your Workspace in MICA_ADMIT_DOMAINS. To admit a personal account, add its address to MICA_ADMIT_EMAILS.

Remove or comment out the MICA_ADMIT_GROUPS line in the example file. Google does not send groups.

4. Start and sign in

docker compose up -d
docker compose logs mica
  1. Open https://cms.example.com/admin/.
  2. Sign in with Google.

You should see the editor with your collections. The log shows the rule in force.

If it does not work

  • Google shows redirect_uri_mismatch. The redirect URI in Google must equal <MICA_PUBLIC_URL>/api/auth/callback, character for character.
  • "No access to this site". The person signed in, but no rule admits them. Check the address in MICA_ADMIT_EMAILS. With the domain rule, the account must belong to your Workspace: a personal Google account is not admitted. Set MICA_LOG_LEVEL=debug to see the reason in the log.
  • The login page says "expired". MICA_PUBLIC_URL is not what the browser shows. Make them identical.
  • Mica says it cannot reach the identity provider. Check that MICA_OIDC_ISSUER is https://accounts.google.com and that the container can reach the internet.

Next

To use another provider, read Other sign-in providers. To manage sessions, backups, and upgrades, go back to Self-hosting.