Google sign-in

Hosted Meshanics can offer Continue with Google as an optional primary sign-in method. It is not public registration. A platform or tenant administrator must create or invite the Meshanics user first, and the Google account must return the same verified email on the first login.

After that first binding, Meshanics identifies the account by Google's stable issuer and subject, not by a mutable email address. Google does not supply the Meshanics tenant, role or permissions.

The sign-in sequence

1. The browser starts an OpenID Connect authorization-code flow with random state, nonce and S256 PKCE values.
2. Meshanics validates the returned token signature, issuer, audience, expiry, nonce and verified-email claim.
3. The server resolves the existing invited user and starts the normal Meshanics pre-authentication challenge.
4. The user enrolls or proves the required authenticator-app factor before an operations session exists.

Meshanics requests only openid, email and profile. It does not request offline access and does not store Google access, ID or refresh tokens.

Password and one-time email-link access remain available. Disabling a user in Meshanics blocks Google login immediately. See Authenticator app sign-in for the required second factor.