Web OAuth 2.0 client ID (*.apps.googleusercontent.com), or 'autoDetect' to read from native config (Androiddefault_web_client_id, iOS WEB_CLIENT_ID in plist).
iosClientId
string | null
no
plist CLIENT_ID
iOS OAuth client ID for GIDConfiguration.clientID. iOS: required via this field or GoogleService-Info.plistCLIENT_ID. Ignored on Android.
offlineAccess
boolean
no
false
Required for serverAuthCode. When true, native authorization requests offline access so sign-in and requestScopes() can return a server auth code for your backend. When false (default), serverAuthCode is always null.
hostedDomain
string | null
no
—
Restrict sign-in to a Google Workspace domain (e.g. example.com). Android: Credential Manager flows (signIn, createAccount) filter at request time; presentExplicitSignIn / buttonFlow validates the JWT hd claim after sign-in. iOS:GIDConfiguration.hostedDomain. Always validate hd on your backend — do not rely on client-side filtering alone.
nonce
string | null
no
auto SHA-256 hex
Nonce embedded in the ID token. If omitted, native code generates a random SHA-256 hex nonce per request.
scopes
string[] | null
no
[]
OAuth scope URLs requested with sign-in / authorization (e.g. https://www.googleapis.com/auth/drive.file).
autoSelectOnSignIn
boolean
no
false
Android: when true, signIn() may auto-select if exactly one authorized account exists. When false, shows account UI when possible.
Throws / errors
Condition
Result
webClientId: 'autoDetect' without generated Android resource or iOS WEB_CLIENT_ID
Error / not configured (add config files or pass explicit Web ID)
Attempts a low-friction sign-in without forcing the full account picker when possible.
Platform
Native behavior
Android
Credential Manager with authorized accounts only (filterByAuthorizedAccounts: true). Respects autoSelectOnSignIn. When offlineAccess: true, may follow with AuthorizationClient to attach a serverAuthCode.
iOS
If GIDSignIn.sharedInstance.currentUser exists → success; else restorePreviousSignIn(). Silent restore returns serverAuthCode: null even when offlineAccess: true — use createAccount() or presentExplicitSignIn() for the initial offline grant.
Returns OneTapResponse (never throws for user cancel — use type: 'cancelled').
Request additional OAuth scopes after the user is signed in. User may see a consent UI.
Parameter
Type
Description
scopes
string[]
Full scope URLs to request (not short names).
Field (result)
Type
Description
serverAuthCode
string | null
OAuth 2.0 server auth code for your backend. Non-null only when configure({ offlineAccess: true }) was called before sign-in. Otherwise always null, even if scope consent succeeds.
Requires prior successful sign-in (configure() + active session). offlineAccess: true in configure() is required before calling requestScopes() when your backend needs a serverAuthCode.
Returns the current user's ID and OAuth access tokens after sign-in. Useful when migrating from @react-native-google-signin/google-signin or when you need to refresh tokens without re-running the account picker.
Field (result)
Type
Description
idToken
string
OpenID Connect ID token (JWT).
accessToken
string
OAuth 2.0 access token for Google APIs.
Platform
Native behavior
Android
Combines the cached ID token from the last Credential Manager sign-in with a fresh access token from AuthorizationClient.authorize(). May show a consent UI if scopes were not yet authorized.
iOS
Reads tokens from the AppAuth session via performAction(freshTokens:). Refreshes from Google when tokens are expired or after clearCachedAccessToken().
Throws:GoogleSignInError with SIGN_IN_REQUIRED when no user is signed in.
Prefer verifying idToken or exchanging serverAuthCode on your backend over sending raw access tokens from the client.
Migration from @react-native-google-signin/google-signin
GoogleOneTapSignIn.getTokens() and clearCachedAccessToken() mirror the legacy API shape. On iOS, clearCachedAccessToken() is not a no-op — it marks the session for refresh so the next getTokens() can obtain new tokens after a 401.
Calls AuthorizationClient.clearToken() — use when Google indicates the access token is invalid before retrying authorization.
iOS
Calls OIDAuthState.setNeedsTokenRefresh() on the user's AppAuth session. The nextgetTokens() performs a network refresh. Validates that accessTokenString matches the current access token when non-empty.
Clears the Google Sign-In session in the native SDK.
Platform
Notes
iOS
GIDSignIn.sharedInstance.signOut().
Android
Calls CredentialManager.clearCredentialState() to clear the user's credential state and disable automatic sign-in semantics until the next successful interactive sign-in.
User email or stable Google account id (OneTapUser.id).
Platform
Behavior
Android
Resolves the account from emailOrUniqueId and revokes via AuthorizationClient.revokeAccess().
iOS
Revokes only the current signed-in session via GIDSignIn.disconnect(). Throws if emailOrUniqueId does not match the active user's id or email. Call signIn() first when revoking a specific stored account.
No saved credential / no previous sign-in to restore — run createAccount() or presentExplicitSignIn() next.
'cancelled'
User dismissed UI (not an thrown error). On Android, Credential Manager also returns this when OAuth is misconfigured (missing release / Play App Signing SHA-1) — see troubleshooting.
OpenID Connect ID token (JWT). Verify on your backend with Google’s keys.
serverAuthCode
string | null
OAuth 2.0 server auth code for your backend. Non-null only when configure({ offlineAccess: true }) was used before sign-in or requestScopes(). Otherwise always null. Exchange on your backend for refresh tokens.
OAuth 2.0 server auth code for the granted scopes. Requires configure({ offlineAccess: true }) before requestScopes(). Without offline access, consent may succeed but this is always null.
const next =await GoogleOneTapSignIn.createAccount()
}
if(isCancelledResponse(response)){
// user dismissed UI
}
Responses vs throws:cancelled and noSavedCredentialFound are normal OneTapResponse values. GoogleSignInError is thrown for Play Services, misconfiguration, in-progress state, etc.
Credential Manager / Google Sign-In request failed (not user cancel).
PLAY_SERVICES_NOT_AVAILABLE
Android — Play Services missing or outdated (checkPlayServices or sign-in).
IN_PROGRESS
No Activity / view controller, or sign-in called before configure().
SIGN_IN_REQUIRED
User must sign in first (getTokens() when no active session).
SIGN_IN_CANCELLED
Reserved / parity — prefer isCancelledResponse() on responses. Also thrown from Android authorization UI cancel.
DEVELOPER_ERROR
Android — OAuth misconfiguration surfaced by Credential Manager / AuthorizationClient (wrong SHA-1, package, or client ID). Note: many SHA-1 issues still appear as type: 'cancelled' — see troubleshooting.
isErrorWithCode(error: unknown): error is GoogleSignInError
Does not call presentExplicitSignIn unless behavior === 'buttonFlow'. Does not invoke onSuccess for noSavedCredentialFound or cancelled (only success).