Run locally

Requires Node.js 20+ and Git 2.38+.

1. Create a Google OAuth client in Google Cloud Console (OAuth client type Web application).
2. Add http://localhost:3000/auth/google/callback as an authorized redirect URI.
3. Copy .env.example to .env and set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET. Optionally set GOOGLE_ALLOWED_DOMAINS to a comma-separated email-domain allowlist.
4. Start the service with npm run dev and open http://localhost:3000.

The callback URL must use the same origin as PUBLIC_URL. For a hosted deployment, set PUBLIC_URL to the HTTPS site URL and register ${PUBLIC_URL}/auth/google/callback in Google Cloud Console. Cookies become Secure when PUBLIC_URL uses HTTPS.

Use HTTPS outside local development because Git access tokens use HTTP Basic authentication. Put the service behind a TLS proxy before exposing it to a network.