Federated Login and Identity Management

6/16/2026

Introduced new OpenID Connect (OIDC) claims, `auth_time` and `amr`, to the ID Token for Sign in with Google. `auth_time` indicates the last successful authentication time with Google, and `amr` provides a reference to the authentication methods used (e.g., password, MFA, hardware key). These claims enable developers to implement more dynamic, risk-based access controls and enhance security by providing insights into the user's Google session freshness and authentication strength.

4/2/2026

This post details the implications of Google Account username changes for platforms integrating with 'Sign in with Google'. It explains how username changes affect user identification, particularly for platforms that rely on email addresses from ID tokens. It recommends using the stable 'subject ID' as the primary user identifier, providing email-based account recovery, and enabling email updates for traditional accounts to prevent duplicate accounts and ensure a smooth user experience.

4/28/2025

Introduced a dedicated 'Google Auth Platform' navigation section in the Google Cloud Console for OAuth configuration, simplifying project registration and app configuration updates. Implemented masking of OAuth client secrets by default, requiring developers to download and manage them securely. Introduced automatic deletion of OAuth clients inactive for 6 months to enhance security against credential theft. Added notifications for client deletion due to inactivity and a 30-day restoration period.

10/24/2024

This post announces the upcoming native support for third-party autofill services in Chrome on Android, deprecating the previous compatibility mode. It details the technical shift from compatibility mode to a native integration, which resolves issues like janky scrolling and duplicate suggestions. The post also provides instructions for developers and users to test the new functionality and outlines the timeline for the deprecation of compatibility mode.

2/13/2024

This post details the migration of Google Identity Services (GIS) to the Federated Credential Management (FedCM) API due to the phasing out of third-party cookies in Chrome. It explains that for most developers, this migration will be seamless via backwards-compatible updates to the GIS library, which will call FedCM APIs behind the scenes. However, some websites with custom integrations (e.g., embedded iframes, non-compliant Content Security Policies) may require minor code changes. The post provides a migration timeline and a checklist for developers to verify functionality and opt-in to FedCM testing, with an option to temporarily exempt traffic until February 2025.

10/26/2023

Introduces Credential Manager as the future of authentication on Android, consolidating various authentication types (passkeys, passwords, federated identity) into a single Jetpack library and UI. Deprecates individual Google Identity Services APIs (One Tap, Credential Saving, Sign in with Google button, Sign-In for Android) in favor of Credential Manager. Announces the removal of Smart Lock for Passwords from the Google Play Services SDK in November 2023.

10/25/2023

Introduces Credential Manager for Android, a unified API for sign-in that supports passkeys, passwords, and federated identity. Details how Credential Manager simplifies user experience by offering a single interface for choosing accounts and automatically selecting the best authentication method. Highlights the open nature of Credential Manager, allowing integration with third-party credential providers like 1Password and Enpass. Provides resources for developers to integrate Credential Manager, including guides, codelabs, and UX guidelines.

10/24/2023

This post details KAYAK's implementation of passkeys on Android using the Credential Manager API and RxJava. It explains the integration flow for both new user registration and existing user sign-in, including code examples for creating and retrieving credentials. It also highlights UX considerations for passkey management and the benefits of using Credential Manager for unifying authentication methods.

10/24/2023

This post details Dashlane's implementation of passkeys, a passwordless authentication technology, highlighting their use of conditional UI on desktop web via browser extensions and the Credential Manager API on Android. It reports significant improvements in conversion rates for both sign-in (92% for passkeys vs. 54% for passwords) and registration (63% for passkeys vs. 25% for passwords), indicating strong user adoption and satisfaction with the new authentication method.

10/2/2023

This post details the restriction of custom URI schemes for OAuth flows in new Chrome extensions and by default for new Android apps. It mandates the use of the Chrome Identity API for extensions and recommends the Google Identity Services for Android SDK for Android apps to mitigate app impersonation attacks and enhance user safety. It also outlines user and developer-facing error messages related to these changes.

8/22/2023

This post announces the beta program for integrating Google Identity Services (GIS) with Chrome's Federated Credential Management (FedCM) API. It explains that FedCM is a privacy-preserving alternative to third-party cookies, which are being phased out by Chrome. FedCM will enable GIS to continue providing secure and streamlined sign-in experiences through browser-native UI, improving user privacy and consistency. The post outlines the migration timeline for developers using GIS's One Tap and Auto Sign-In features, encouraging participation in the beta program to prepare for the deprecation of third-party cookies.

7/26/2023

This post details the user experience design and implementation of passkeys for Google Accounts. It outlines the strategic design principles of ease of use and security, the user journey for introducing and creating passkeys, and the management interface for passkeys within Google Account settings. It highlights the association of passkeys with familiar security experiences like biometrics and the importance of user education and gradual adoption. The post also describes the organization of passkeys by ecosystem and the available management actions (rename, revoke).

1/18/2023

This post details the migration from App Engine's built-in Users API to Cloud Identity Platform. It outlines the technical steps involved, including migrating user data, updating authentication flows, and adapting application code to leverage Cloud Identity Platform's features. The post emphasizes the benefits of this migration, such as improved security, scalability, and a more robust identity management solution.

11/9/2022

Introduced an open-source Pass Converter for Mobile Wallets, enabling developers to convert passes from various formats (e.g., Apple Wallet, generic JSON) into the Google Wallet Pass format. This tool simplifies the process of migrating existing pass data and integrating with Google Wallet, supporting common pass types like loyalty cards, event tickets, and gift cards.

9/13/2022

The Google Identity Services (GIS) library has been updated to support passkeys, offering a more secure and convenient alternative to passwords. This update includes the introduction of the Credential Manager for Android, which unifies support for passkeys, passwords, and federated identity in a single interface, simplifying the sign-in experience for users. The library also now supports the WebAuthn API, enabling cross-platform passkey authentication.

4/8/2022

This post details how to use OAuth 2.0 tokens on websites, apps, and servers, providing guidance on obtaining and using access tokens for Google APIs. It covers obtaining user consent, refreshing tokens, and best practices for secure token management, including the use of PKCE for public clients and server-side token storage.

3/1/2022

This post announces the discontinuation of authorization support for the Google Sign-In JavaScript Platform Library. It advises developers to migrate to the Identity Services library for continued authorization functionality, outlining the deprecation timeline and providing guidance on the migration process.

2/16/2022

This post introduces the adoption of more secure OAuth flows for Google OAuth interactions, aiming to enhance the safety and security of user authentication and authorization processes. It emphasizes the importance of using these improved flows to protect user data and prevent potential vulnerabilities.

2/15/2022

This post announces the addition of authorization support for Google Identity Services APIs. It details how developers can now integrate OAuth 2.0 flows to enable user authentication and authorization within their applications. The post highlights the benefits of this new support, including simplified integration of secure access to user data and resources, granular control over permissions and scopes, and enhanced security and user privacy. It also mentions that this feature is now available for developers to use.

10/11/2021

Introduced improvements to Google OAuth's incremental authorization, enabling developers to request specific scopes of user data. This allows for more granular permission granting, enhancing user privacy and control by ensuring users only share necessary information. The changes aim to reduce authorization friction.

8/3/2021

This post introduces authorization support for Google Identity Services APIs, enabling developers to integrate OAuth 2.0 flows for user authentication and.

6/29/2021

This post details upcoming security changes to Google's OAuth 2.0 authorization endpoint when accessed via embedded webviews. It introduces new security measures to prevent authorization code interception attacks, including stricter validation of redirect URIs and the use of PKCE (Proof Key for Code Exchange) by default for new OAuth clients. The changes aim to enhance the security of the authorization flow and protect user credentials.

7/8/2020

Introduces OAuth-based App Flip for Actions, enabling seamless authentication and authorization flows between Google Assistant Actions and other applications. This feature leverages OAuth to securely transfer user context and permissions, allowing users to transition from an Action to a specific app without re-authentication, thereby improving user experience and engagement.

10/8/2018

This post introduces the ability to request more granular permissions for Google Account access via OAuth 2.0 and Google APIs. Previously, developers requested broad scopes. Now, they can request specific permissions for individual data types (e.g., specific contact fields, calendar event details) through the Google Identity Services APIs. This enhances user privacy and control by allowing them to grant access only to the data their application truly needs.

9/21/2016

Introduced the OAuth 2.0 token revocation endpoint for Google Identity Services, enabling users to revoke access for specific applications and enhancing account security. This addresses the need for users to manage and control third-party access to their data.

8/22/2016

This post introduces modernization of OAuth interactions in native applications by leveraging system browsers for authentication flows, enhancing security and usability. It details the shift away from embedded web views to prevent credential leakage and improve user experience.

6/23/2016

Introduces Firebase Authentication, a new service for mobile and web applications that simplifies user authentication by supporting multiple sign-in providers (email/password, Google, Facebook, Twitter, GitHub) and handling security and scalability concerns. This complements existing efforts in federated login and identity management.

4/22/2016

This post announces the deprecation of OAuth 1.0 (2LO) for Google APIs, encouraging developers to migrate to OAuth 2.0. It highlights the security benefits of OAuth 2.0, such as improved token management and broader adoption, and provides resources to aid in the migration process.

7/20/2015

Introduces Application Default Credentials (ADC) for Google Cloud APIs. ADC simplifies authentication by automatically discovering credentials based on the environment (e.g., GCE, GKE, local development with `gcloud auth application-default login`). This reduces the need for manual credential management and improves security by allowing applications to run with the least privilege necessary.

5/28/2015

This post introduces the Google Identity Platform, a unified identity management solution for Google services and third-party applications. It aims to simplify authentication and authorization by providing a single, consistent API for developers to integrate with Google's identity infrastructure. This includes support for OAuth 2.0 and OpenID Connect, enabling secure and standardized access to user data.

4/21/2015

This post announces the deprecation and eventual shutdown of ClientLogin, OAuth 1.0 (3LO), AuthSub, and OpenID 2.0. It highlights the transition to OAuth 2.0 as the preferred and more secure authentication protocol for Google APIs, encouraging developers to migrate their applications to avoid service disruptions.

3/20/2015

This post serves as a reminder to developers to migrate from older OAuth versions to OAuth 2.0 or OpenID Connect. It highlights the security benefits and the eventual deprecation of older protocols, urging developers to update their applications to ensure continued access to Google services and maintain a secure user experience.

2/18/2015

This post announces the retirement of the Email Migration API, signaling a shift away from older methods of email data access and migration. This implies a move towards more modern and secure authentication protocols for accessing email services, aligning with the broader theme of federated login and identity management.

9/24/2014

This post introduces the Google Apps Activity API, which provides developers with programmatic access to user activity data across Google Apps. This new API allows for richer integrations and insights into user behavior within the Google ecosystem, complementing existing efforts in federated login and identity management by enabling more sophisticated applications that leverage user activity data.

9/23/2014

This post introduces two key enhancements to the Admin SDK: custom user attributes and expanded access to all domain users. Custom user attributes allow for more granular and flexible user data management, enabling developers to store and retrieve specific information relevant to their applications. The expansion of access to all domain users simplifies management for administrators and developers by removing previous limitations on which users could be accessed via the SDK. These features aim to improve the flexibility and power of identity management within Google Workspace.

4/23/2014

This post announces upcoming security changes that will deprecate older authentication methods for Google applications, mandating the use of OAuth 2.0 for improved security and user data protection. It highlights the risks associated with non-OAuth 2.0 applications and provides guidance for developers to migrate to the more secure protocol.

3/19/2014

This post announces improvements to the Google Calendar API, focusing on enhanced functionality and developer experience. It highlights new features and refinements that make it easier for developers to integrate Google Calendar into their applications, thereby contributing to the broader ecosystem of integrated services and developer tools.

12/11/2013

Introduced a new OAuth 2.0 flow for Google+ Sign-In, offering improved security and a more streamlined user experience. Deprecated the old OAuth 1.0a flow to encourage adoption of the more secure and modern OAuth 2.0 standard.

6/5/2013

This post makes Google's CalDAV and CardDAV APIs publicly available, enabling broader access to Google Calendar and Google Contacts data through standard protocols. This democratizes access for developers and users, fostering interoperability with third-party applications.

5/15/2013

Introduces the concept of cross-platform Single Sign-On (SSO) technology and its importance for user experience across applications.

2/26/2013

Introduced Google+ Sign-In, a new authentication mechanism designed to simplify and secure user sign-in for developers. This feature aims to reduce social spam by allowing users to control the information shared and provides a more streamlined experience compared to traditional social logins. It leverages existing Google identity infrastructure to provide a secure and user-friendly authentication solution.

9/17/2012

This post introduces OAuth 2.0 support for IMAP/SMTP and XMPP, enhancing authentication security for developers and users by providing a more robust and standardized authorization framework for accessing Google services.

6/18/2012

Introduced the OAuth 2.0 Playground, a web-based tool that allows developers to test OAuth 2.0 authorization flows with Google APIs, specifically demonstrating its use with the Google Drive API. This provides a hands-on way for developers to understand and implement OAuth 2.0 for accessing Google services.

3/29/2012

Introduced new features to the OAuth 2.0 Playground to simplify testing and understanding of OAuth 2.0 flows, including support for various Google APIs and improved user interface for managing authorization requests and responses.

3/20/2012

Introduced Service Accounts as a new method for applications to authenticate with Google APIs, allowing them to access user data without requiring user interaction. This enhances security and enables server-to-server communication.

11/28/2011

This post introduces fine-grained access control for Google Cloud Storage, allowing developers to manage permissions at a more granular level. It highlights the use of OAuth 2.0 for authorizing access to Cloud Storage resources, simplifying the process for developers and enhancing security. This represents a significant step in making cloud storage more accessible and manageable for applications.

11/14/2011

This post announces upcoming changes to the OAuth 2.0 endpoint, which will affect how applications authenticate and access Google services. It highlights the importance of updating applications to use the new endpoint to ensure continued functionality and security. The changes are intended to improve the robustness and security of the OAuth 2.0 implementation.

11/8/2011

Introduced the OAuth 2.0 Playground, a tool for developers to test and understand OAuth 2.0 authorization flows, including obtaining access tokens and making authorized API requests. This enhances developer experience and facilitates integration with Google services.

9/19/2011

This post announces the integration of OAuth 2.0 into the Google APIs Client Library for Java. This is a significant step in simplifying and standardizing the process for developers to securely access Google APIs on behalf of users, building upon previous OAuth implementations.

3/16/2011

This post outlines best practices for user authentication, focusing on secure password handling (e.g., avoiding plain text storage, using strong hashing algorithms), robust session management (e.g., secure cookie handling, session timeouts), and the appropriate use of OAuth for delegated authorization. It emphasizes the importance of these practices for building secure and trustworthy applications.

3/15/2011

This post announces the mandatory use of SSL for all Google API requests, significantly enhancing the security of API interactions and protecting user data in transit. It marks a crucial step in solidifying the security posture of Google's developer platform and promoting best practices for secure API usage.

3/14/2011

Introduced OAuth 2.0 as the new standard for authorizing access to Google APIs, replacing the previous OAuth 1.0a. Detailed the benefits of OAuth 2.0, including improved security, broader adoption, and simplified implementation for developers. Provided guidance on migrating from OAuth 1.0a to OAuth 2.0 and outlined the new authorization flows.

11/29/2010

Introduced a sample OpenID relying party site to demonstrate the implementation of OpenID for authentication, providing developers with a practical example for integrating OpenID into their applications.

9/27/2010

Introduced new OAuth support for Google Apps APIs, enabling developers to grant third-party applications secure access to user data within Google Apps.

9/7/2010

Introduced 'Sign up with Google' functionality leveraging OpenID, enabling users to create accounts on third-party websites using their Google credentials. This simplifies user onboarding and enhances security by centralizing identity management.

5/18/2010

This post introduces the ability to connect to Google Apps from outside of Google's network using OAuth. It details how developers can integrate Google Apps services into their own applications and systems by implementing OAuth 2.0 for authentication and authorization, enabling secure access to user data and services. The post likely provides technical guidance on establishing these external connections, including handling authentication flows and managing API access.

3/30/2010

This post introduces OAuth 2.0 support for accessing Gmail via IMAP and SMTP. This allows applications to access user mailboxes securely without requiring users to share their passwords, enhancing security and user experience.

1/29/2010

Introduced support for ActionScript within the AuthSub authentication system, allowing Flash applications to leverage AuthSub for secure user authentication and access to Google services.

11/3/2009

Introduced new OAuth support for Google Apps APIs, simplifying and enhancing authentication security for developers and users. This update adds support for OAuth 2.0, allowing for more granular permissions and improved security for applications accessing Google services.

7/28/2009

This post introduces the integration of OpenID with Google Apps, enabling Google Apps to function as an identity hub for Software as a Service (SaaS) applications. This allows users to leverage their Google credentials for authentication with third-party services, simplifying the login process and enhancing security by centralizing identity management.

7/21/2009

This post contributes to the feature thread by detailing specific techniques for building more responsive and engaging web applications for mobile devices, specifically focusing on the 'autogrowing textareas' feature within the Gmail for Mobile HTML5 Series. This highlights advancements in client-side development for richer user experiences on mobile platforms.

7/2/2009

This post contributes to the thread by demonstrating how to leverage HTML5 features, specifically timers, within the context of Gmail for Mobile. This showcases advancements in building more responsive and engaging mobile web applications, aligning with the broader theme of enabling richer web experiences through developer tools and platforms.

6/22/2009

This post introduces the Virtual Keyboard API, a new developer tool that allows for the integration of virtual keyboards into web applications. This enhances user input capabilities, particularly for devices with limited physical keyboards, and contributes to the broader theme of enabling richer web applications through developer tools.

5/14/2009

This post announces the release of the Google OpenID API, enabling developers to integrate federated login and identity management into their applications. This allows users to log in using their Google accounts, simplifying the authentication process and enhancing security.

5/13/2009

This post introduces the use of AppCache (Application Cache) within the Gmail for mobile HTML5 series. AppCache allows web applications to store resources locally, enabling them to function offline and load faster. This directly contributes to the thread's theme of enabling richer, more accessible web applications by providing offline functionality.

5/7/2009

This post introduces the use of AppCache to enable offline functionality for Gmail on mobile devices, a key step in building robust and accessible web applications that can function without a constant network connection. This builds upon earlier efforts to provide developers with tools for richer web applications.

4/28/2009

This post introduces AppCache as a core HTML5 technology for enabling offline functionality in mobile web applications, exemplified by its use in Gmail for mobile. This directly contributes to the theme of providing developers with tools for richer web applications by enabling offline access, a crucial aspect of modern web development.

10/29/2008

This post announces Google's move towards single sign-on (SSO) by adopting the OpenID protocol. This aims to simplify user authentication by allowing users to log in to multiple services with a single set of credentials.

10/21/2008

This post introduces the Gears Geolocation API, a significant expansion of Google Gears that provides developers with a standardized method to access location data from laptop WiFi networks. This enables the creation of location-aware applications, enhancing the capabilities of web applications beyond offline access.

10/9/2008

This post highlights Zoho Mail's adoption of Google Gears for offline access, showcasing how Google's technologies can enable richer, more integrated web applications. This indirectly supports the broader ecosystem of identity and access management by providing foundational tools for offline functionality and enhanced user experiences.

7/9/2008

This post introduces the use of Protocol Buffers for efficient data serialization within Google's systems, offering a language-neutral, platform-neutral, extensible mechanism for serializing structured data. It also announces Selenium Ice, a new tool for automated testing of web applications, aimed at improving the reliability and quality of web services.

6/27/2008

This post announces the availability of OAuth for Google Data APIs, enabling developers to grant third-party applications access to user data without sharing user credentials. It details the process of obtaining an OAuth consumer key and secret, and how to use them to request authorization from users. This marks a significant step in enhancing security and user control over data access.

7/14/2006

Introduces Google Account authentication, allowing users to log in to third-party applications using their Google credentials. This enhances security and simplifies the authentication process for developers and users.