> ## Documentation Index
> Fetch the complete documentation index at: https://docs.capedigital.co.ke/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign in with Google (direct identity-token verification)

> Verify a Google identity token directly and issue session tokens.

Not brokered through Keycloak — see
authentication/services/google_identity_token.py: Keycloak's own Google
broker forces the browser through first-broker-login, including a
one-time "Link Google" screen the first time an existing account links a
Google identity. This path skips Keycloak's hosted UI entirely, for any
client that obtains a Google identity token itself.



## OpenAPI

````yaml /openapi/user.yaml post /api/v1/auth/social/google
openapi: 3.0.3
info:
  title: CapeMedia User Service API
  version: 1.0.0
  description: |2-

        **CapeMedia User Service API** - Comprehensive user service and management system.

        ## Authentication
        This API uses **JWT Bearer tokens** for authentication.

        1. Login via `/api/v1/auth/login` to obtain tokens
        2. Include the access token in the `Authorization` header: `Bearer <access_token>`
        3. Refresh expired tokens via `/api/v1/auth/refresh-token`

        ## Versioning
        The API uses URL path versioning (e.g., `/api/v1/`, `/api/v2/`).
        Current version: **v1**
        
  contact:
    name: API Support
    email: support@capemedia.co.ke
  license:
    name: Cape Media
servers:
  - url: https://api.diginacape.co.ke/acl
    description: Production
  - url: http://sapi.diginacape.co.ke/acl
    description: Local development
security: []
paths:
  /api/v1/auth/social/google:
    post:
      tags:
        - Authentication
      summary: Sign in with Google (direct identity-token verification)
      description: |-
        Verify a Google identity token directly and issue session tokens.

        Not brokered through Keycloak — see
        authentication/services/google_identity_token.py: Keycloak's own Google
        broker forces the browser through first-broker-login, including a
        one-time "Link Google" screen the first time an existing account links a
        Google identity. This path skips Keycloak's hosted UI entirely, for any
        client that obtains a Google identity token itself.
      operationId: auth_social_google
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GoogleSignInRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/GoogleSignInRequest'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/GoogleSignInRequest'
        required: true
      responses:
        '200':
          description: No response body
      security:
        - bearerAuth: []
        - {}
components:
  schemas:
    GoogleSignInRequest:
      type: object
      properties:
        identity_token:
          type: string
          minLength: 1
          description: >-
            Google's signed identity token (id_token) — from Google Identity
            Services (web) or a native Google Sign-In SDK.
        realm:
          type: string
          minLength: 1
          default: capedigi
          description: Keycloak realm name. Defaults to the consumer realm.
      required:
        - identity_token
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Enter your JWT token in the format: Bearer <token>'

````