Google One Tap Sign-In

Every extra step at sign-in costs you customers: someone forgets the password, someone refuses to fill in a registration form, someone simply closes the tab. Google One Tap Sign-In removes that barrier. The visitor sees the familiar Google panel with their own account, one click, and they are in the store with a ready profile, no password, no confirmation e-mails. New customers register without noticing it, returning ones land straight in their account with the order history, and the cart makes it to checkout. The trusted Google brand reassures shoppers, and the official button looks as polished as on the biggest services. Setup takes minutes: paste the Client ID from Google Cloud and switch the add-on on.

One-click sign-in

1. The official Google button

   The button is rendered by Google itself, with the logo and in the customer's language; a visitor already signed in to Google in the browser sees their name, e-mail and picture on it. One click, an account choice in the Google pop-up, and the customer is in. No password, no confirmation e-mail.

2. Wherever a sign-in is needed

   The button appears in the sign-in pop-up in the header, on the sign-in page, in the checkout sign-in form and on the registration page under the line "or register in one click". Below the regular form it sits behind an "or" divider and does not break the theme layout.

3. Tailored to your store

   Button caption ("Sign in", "Sign in with Google", "Sign up with Google", "Continue with Google"), light, blue or black theme, three sizes, rectangular or pill shape, a fixed width or the width of the form.

4. Together with Yandex ID

   Next to the "Yandex ID Sign-In" add-on the Google and Yandex buttons line up in one column under a shared divider, so the customer picks the service they are used to.

After signing in the customer stays on the current page, goes to the account page or to any address you choose.

One Tap prompt

1. The account is already there

   A guest who is signed in to Google in the browser sees a small Google panel with their accounts in the corner of the page. One click and they are in the store: no hunting for the sign-in form, no password to recall, no registration form. Customers already signed in to the store never see the panel.

2. Automatic sign-in

   A separate mode for returning customers: if the visitor has signed in to the store through Google before and there is exactly one Google session in the browser, One Tap signs them in on its own, without a click.

3. Not intrusive

   The prompt closes with the cross. Closing on a click outside the panel is a separate option, and the add-on warns you: Google treats such a dismissal as a refusal and stops showing the panel on your site for a while. In Chrome the prompt works through FedCM.

4. Clear diagnostics

   Google does not always show One Tap: no Google session, the prompt was dismissed recently, HTTP instead of HTTPS, third-party sign-in blocked in Chrome. All the reasons and the ways to reset them are listed right in the add-on settings, and the reason of the last attempt is printed to the browser console.

Customer accounts

1. Registration without a form

   If there is no customer with that e-mail in the store, an account is created on the fly: first and last name from the Google profile, the e-mail already verified by Google. The store's standard registration e-mail can be sent. The customer sees a welcome message and carries on shopping.

2. Existing customers

   If the e-mail is already registered, the customer enters their existing account with the order history, and Google gets linked to the profile. Blank first and last name in the profile are filled from Google; filled fields are left alone. This link-up can be switched off: the customer is then asked to sign in with the password and link Google in the profile settings.

3. Guest orders are not lost

   Orders placed as a guest before signing in are attached to the account.

4. Managed in the account area

   In the profile the customer sees the linked Google account with the picture and e-mail and can unlink it with one button or link it again. A customer who is already signed in links Google with the same button. One Google account cannot be linked to two customers, and when an account is deleted the link goes with it.

The customer needs no password, yet the regular sign-in is still there: a password can be set through "Forgot your password?".

Security and control

1. Verified on the store server

   The customer's browser receives a signed ID token from Google, and the store verifies it itself: the signature against Google's public keys, the issuer, the lifetime, the audience (your own application) and the verified e-mail flag. The keys are cached; if they are unavailable, a fallback check through Google's service is used. No application secret is needed or stored anywhere.

2. Customers only

   Only customers can sign in through Google. Administrator and Multi-Vendor vendor accounts are never affected, even when they share the e-mail.

3. Allowed e-mail domains

   For B2B and corporate stores the sign-in can be limited to a list of domains, e.g. company.com, partner.org: visitors with other Google accounts get a clear refusal.

4. Log of rejected sign-ins

   Optionally, every failed attempt is written to Administration → Logs with the reason and the e-mail: unverified address, foreign domain, disabled account, an attempt to enter as an administrator.

The return address after signing in is checked against your store hosts: a customer cannot be sent to a foreign site through a link parameter.

Add-on settings

• Google Cloud:

  the application Client ID with step-by-step instructions on how to get it in Google Cloud Console and a ready list of your store addresses for the Authorized JavaScript origins field. Allowed e-mail domains.

• Button:

  show in sign-in forms, caption, theme (light, blue, black), size, shape (rectangular or pill), width.

• One Tap:

  show to guests, automatic sign-in for returning customers, close on a click outside the prompt. A note on why the prompt may not appear and how to reset it lives right there.

• Customer accounts:

  create accounts for new customers, send the registration e-mail, sign in to existing accounts by e-mail, keep customers signed in, where to go after signing in (current page, account page or a custom address).

• Diagnostics:

  rejected sign-in attempts with the reason are written to the administrator log.

In Multi-Vendor and multi-storefront stores the settings are kept per storefront. Developers get the csc_google_oauth_create_user hook to complete customer data before the account is created.