
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@react-native-auth/google
Advanced tools
🎯 Modern Authentication
|
⚡ Built with Latest Tech
|
| Method | Description | Use Case |
|---|---|---|
oneTap() | One Tap / Credential Manager | Quick sign-in for returning users |
signIn() | Account Chooser UI | First-time sign-in, account selection |
legacySignIn() | Legacy OAuth with scopes | Advanced features (Drive, Calendar, etc.) |
signOut() | Sign out current user | Logout, clear session |
# Using npm
npm install @react-native-auth/google
# Using yarn
yarn add @react-native-auth/google
Add to your android/gradle.properties:
newArchEnabled=true
kotlin.version=2.1.20
Go to Google Cloud Console and create/select your project.
You need TWO client IDs:
For app verification (SHA-1 fingerprint required)
Go to APIs & Services → Credentials
Click Create Credentials → OAuth 2.0 Client ID
Select Android
Fill in:
Name: Your App (Android)
Package name: com.yourapp (from android/app/build.gradle)
SHA-1 fingerprint: Get it by running:
# Debug
keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android
# Release
keytool -list -v -keystore /path/to/release.keystore -alias your-alias
Click Create
For authentication (USE THIS IN YOUR CODE)
Your App (Web)xxxxx.apps.googleusercontent.com💡 Pro Tip: The Android Client ID verifies your app. The Web Client ID is used for authentication.
import { oneTap, signIn, legacySignIn, signOut } from '@react-native-auth/google';
Quick authentication for returning users with saved credentials.
const CLIENT_ID = 'YOUR_WEB_CLIENT_ID.apps.googleusercontent.com';
try {
const result = await oneTap({ clientId: CLIENT_ID });
console.log('✅ Signed in:', result.idToken);
console.log('📧 Email:', result.email);
} catch (error) {
console.error('❌ Sign-in failed:', error);
}
Display account picker UI for first-time users or account switching.
const result = await signIn({
clientId: CLIENT_ID,
});
Advanced authentication with custom OAuth scopes (Drive, Calendar, etc.)
const result = await legacySignIn({
clientId: CLIENT_ID,
scopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/calendar.readonly',
],
prompt: 'consent', // Optional: Force consent screen
});
prompt ParameterControls the authentication flow behavior:
| Value | Behavior |
|---|---|
undefined | Default behavior - no forced interaction |
'consent' | Always show consent screen, even for existing app |
'login' | Always show login screen, force account selection |
'select_account' | Always show account selection screen |
'none' | Silent authentication (may fail if no session) |
Example - Force Consent Screen:
const result = await legacySignIn({
clientId: CLIENT_ID,
scopes: ['https://www.googleapis.com/auth/calendar'],
prompt: 'consent', // Useful when updating permissions
});
Example - Force Account Selection:
const result = await legacySignIn({
clientId: CLIENT_ID,
prompt: 'select_account', // Always show account picker
});
Example - Force Login:
const result = await legacySignIn({
clientId: CLIENT_ID,
prompt: 'login', // Useful for switching accounts
});
Sign out the current user and clear the session.
try {
await signOut();
console.log('✅ Signed out successfully');
} catch (error) {
console.error('❌ Sign-out failed:', error);
}
type GoogleAuthOptions = {
clientId: string; // Your Web Client ID
scopes?: string[]; // OAuth scopes (legacySignIn only)
prompt?: string; // Consent behavior: 'consent', 'login', 'none'
};
type GoogleAuthResult = {
idToken: string; // JWT ID token
email?: string; // User email (if available)
};
Made with ❤️ for React Native
FAQs
Modern Google Authentication for React Native
We found that @react-native-auth/google demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.