WEB APPS Use the "Google Oauth" API call (OAuth2 User-Agent Flow) to sign users in through the browser. Configure your Google OAuth 2.0 client (Web application type) in Google Cloud Console and add the callback URL shown in the API calls tab.

NATIVE MOBILE APPS
Native mobile Bubble apps don't support the browser-based OAuth2 user-agent flow, so use the server-side "Verify Google ID Token" action instead:

1. On the mobile device, obtain a Google ID token using a native Google Sign-In SDK (iOS: Google Sign-In for iOS; Android: Credential Manager / One Tap). Configure a Google OAuth 2.0 client of the appropriate platform type (iOS / Android) in Google Cloud Console.

2. (Recommended) Generate a random nonce on the client and pass it to the Google Sign-In request. Keep a copy of the nonce in your Bubble workflow state.

3. Call the "Verify Google ID Token" server-side action with:
  - Google ID token = the id_token you received from the device
  - Expected Google OAuth Client ID = the client ID you configured for your mobile platform
  - nonce = (optional) the same nonce you generated in step 2

4. The action verifies the token signature, issuer, audience, expiry (with 30s clock-skew tolerance) and optional nonce against Google's tokeninfo endpoint, and returns the user's verified profile (id, email, email_verified, name, given_name, family_name, picture, locale). If valid=no, the error field explains why.

5. In your workflow, use the returned id (Google sub) or email to look up or create a Bubble user.

Reference: https://developers.google.com/identity/protocols/OAuth2
ID token verification: https://developers.google.com/identity/sign-in/web/backend-auth