TechPrufer
Get started
Google
Google logoGoogle · Feature trail

Federated Login and Identity Management

74 posts · Jun 2008 – Jun 2026

What this trail covers

Google's evolution in providing secure and flexible access to user data and services through standardized protocols has progressed from foundational identity management and access control mechanisms like OAuth access to IMAP/SMTP in Gmail. Subsequent developments expanded OAuth support for Google Apps APIs, enabling secure access to user data. The user experience of passkeys for Google Accounts has been introduced, detailing the design principles of ease of use and security, the transition strat. This post introduces simplified OAuth configuration in the Google Cloud Console, masking of OAuth client secrets, and automatic deletion of unused OAuth clients to enhance security and usability.

All Google trails
  1. Enhance Security and Trust: New Session Metadata in Sign in with Google- Google Developers BlogIntroduced new OpenID Connect (OIDC) claims, `auth_time` and `amr`, to the ID Token for Sign in with Google. `auth_time` indicates the last successful Google session authentication time, and `amr` lists the authentication methods used (e.g., `pwd`, `mfa`, `hwk`). These claims enable developers to implement risk-based session policies, step-up authentication, and enhanced audit logging for improved security and fraud prevention.
  2. Supporting Google Account username change in your app- Google Developers BlogThis post explains the technical implications of Google Account username changes for applications integrating with Sign in with Google. It details how subject ID remains stable, while email addresses can change. It outlines potential disruptions for platforms identifying users by email address, especially when OAuth grants are revoked, and recommends using subject ID as the primary identifier, providing email-based account recovery, and enabling email updates for traditional accounts to prevent duplicate accounts and ensure seamless user transitions.
  3. Usability and safety updates to Google Auth Platform- Google Developers BlogThis post details several updates to Google's identity platform, focusing on usability and safety for developers. Key changes include: 1. A dedicated 'Google Auth Platform' navigation section in the Google Cloud Console for simplified OAuth configuration, project registration, and app updates. 2. A change to how OAuth client secrets are displayed, moving from direct visibility to masking after creation, requiring developers to download and manage them securely (e.g., using Secret Manager). 3. Automatic deletion of OAuth clients inactive for 6 months to mitigate credential theft. Developers will be notified of these changes and can restore deleted clients within 30 days.
  4. Chrome on Android to support third-party autofill services natively- Google Developers BlogThis post announces the upcoming native support for third-party autofill services in Chrome on Android, deprecating the previous compatibility mode. It details the technical shift from compatibility mode to a native integration, which resolves issues like janky scrolling and duplicate suggestions. The post also provides instructions for developers and users to test the new functionality and outlines the timeline for the deprecation of compatibility mode.
  5. Federated Credential Management (FedCM) Migration for Google Identity Services- Google Developers BlogThis post announces the migration of Google Identity Services (GIS) web developers to the Federated Credential Management (FedCM) API, driven by Chrome's phase-out of third-party cookies. It details the timeline for this migration, which will occur automatically for most developers through backwards-compatible updates to the GIS library. It also highlights that some websites with custom integrations may require minor code changes and encourages developers to test FedCM functionality. An exemption is available until February 2025.
  7. Updates to Google Identity Services (GIS) and migration to the Credential Manager API- Google Developers BlogThis post announces the deprecation of Google Identity Services (GIS) authentication APIs on Android (One Tap sign-in, Credential Saving, Sign in with Google button, and Sign-In for Android) in favor of the new Credential Manager Jetpack library. It highlights Credential Manager's role in consolidating authentication types into a single UI, supporting passkeys, and simplifying integration with various identity providers and password managers. Smart Lock for Passwords is also being removed from the Google Play Services SDK in November 2023. Developers are strongly encouraged to migrate to Credential Manager.
  8. Simple and secure sign-in on Android with Credential Manager and passkeys- Google Developers BlogIntroduces Credential Manager for Android, a new API that unifies passkeys, passwords, and federated identity sign-in methods into a single interface. Highlights passkeys as a more secure and convenient alternative to passwords, citing a 50% reduction in sign-in time for integrated apps. Details the user experience of choosing an account and the system's smart defaults for selecting the best sign-in technology. Emphasizes the open nature of Credential Manager, allowing integration with third-party credential providers like 1Password and Enpass. Provides resources for developers to integrate the API.
  9. How KAYAK reduced sign in time by 50% and improved security with passkeys- Google Developers BlogThis post details KAYAK's implementation of passkeys on Android using the Credential Manager API and RxJava. It explains the problem of password-based authentication, the solution offered by passkeys, and provides code examples for integrating passkey creation and sign-in flows. It also highlights UX considerations for passkey management.
  10. Password manager Dashlane sees 70% increase in conversion rate for signing-in with passkeys compared to passwords- Google Developers BlogThis post details Dashlane's implementation of passkeys, leveraging the Credential Manager API on Android and conditional UI via browser extensions on desktop web. It highlights the technical choices made to integrate passkeys as a passwordless authentication method, including the use of the Credential Manager API for unified sign-in flows and conditional UI for graceful transitions between password and passkey logins. The results section quantifies the impact of this implementation, showing significant improvements in conversion rates for both authentication and registration opportunities, as well as growth in passkey usage.
  11. Improving user safety in OAuth flows through new OAuth Custom URI scheme restrictions- Google Developers BlogThis post announces the restriction of custom URI schemes for OAuth flows in new Chrome extensions and Android apps by default, to enhance user safety and prevent app impersonation. New Chrome extensions must use the Chrome Identity API. New Android apps will default to not allowing custom URI schemes, with a recommendation to use the Google Identity Services for Android SDK. Existing configurations are not affected but migration is strongly encouraged. User and developer-facing error messages for these changes are also detailed.
  12. Announcing Federated Credential Management (FedCM) Beta for Google Identity Services- Google Developers BlogThis post announces the beta program for Google Identity Services (GIS) integration with Chrome's Federated Credential Management (FedCM) API. It details the 'Why FedCM' rationale, emphasizing improved privacy and user experience due to the phasing out of third-party cookies. It outlines the changes for GIS developers, noting that most migrations will be seamless via GIS JavaScript library updates, but some websites may require minor adjustments. The post also describes the FedCM user experience and provides a timeline for the gradual transition of traffic to FedCM, starting in November 2023 and reaching 100% by mid-2024, in preparation for Chrome's default third-party cookie blocking in late 2024. Developers are encouraged to join the beta program and provide feedback.
  13. Designing the user experience of passkeys on Google accounts- Google Developers BlogThis post details the user experience design and implementation of passkeys for Google Accounts. It covers the strategic design principles (ease of use, security), user transition strategies (leading with convenience, associating with familiar security experiences, introducing passkeys when relevant), the creation moment UI (browser-specific modals, passkey icon usage, confirmation screens), the sign-in flow (familiarity through consistent UI), and passkey management (ecosystem-based categorization, metadata, user actions like renaming and revoking). It also touches on the underlying technology and user concerns regarding data privacy.
  14. Migrating from App Engine Users to Cloud Identity Platform (Module 21)- Google Developers BlogThis post details the migration from App Engine's built-in Users API to Cloud Identity Platform. It outlines the technical steps involved, including migrating user data, updating authentication flows, and adapting application code to leverage Cloud Identity Platform's features. The post emphasizes the benefits of this migration, such as improved security, scalability, and a more robust identity management solution.
  15. New Features Available in the Google Identity Services (GIS) Library - Google Developers BlogThe Google Identity Services (GIS) library has been updated to support passkeys, offering a unified API for authentication and authorization across platforms. This includes support for the WebAuthn API, enabling the use of passkeys for passwordless sign-in, and improved integration with existing Google authentication flows.
  16. Discontinuing authorization support for the Google Sign-In JavaScript Platform Library- Google Developers BlogThis post announces the discontinuation of authorization support for the Google Sign-In JavaScript Platform Library, effective March 1, 2023. It recommends migrating to the Google Identity Services (GIS) library for continued functionality and enhanced security. The GIS library offers improved user experience and security features, including support for passkeys and better handling of consent.
  17. Making Google OAuth interactions safer by using more secure OAuth flows - Google Developers BlogThis post details how Google is enhancing the security of its OAuth interactions by adopting more secure OAuth flows. It emphasizes the importance of using authorization code flow with proof key for code exchange (PKCE) for public clients and hybrid flows for confidential clients to mitigate authorization code interception attacks. The post also highlights the use of token introspection and the benefits of these more secure flows for protecting user data and preventing unauthorized access.
  18. Announcing authorization support for Google Identity Services APIs- Google Developers BlogThis post announces the general availability of authorization support for Google Identity Services APIs, enabling developers to integrate OAuth 2.0 authorization flows into their applications. It details how to implement authorization requests, handle consent screens, and manage access tokens, providing a more secure and standardized way for users to grant applications access to their Google data.
  19. Google OAuth incremental authorization improvement- Google Developers BlogIntroduced incremental authorization for OAuth, allowing applications to request specific scopes of user data only when needed, reducing the amount of data exposed to third-party applications and improving user privacy and security.
  20. Launching our new Google Identity Services APIs- Google Developers BlogThis post announces the launch of new Google Identity Services APIs, which provide a more streamlined and secure way for developers to integrate Google Identity into their applications. Key features include improved user experience for sign-in flows, enhanced security with support for passkeys, and a unified API for managing user identities across Google products. The new APIs aim to simplify the integration process for developers and offer a more robust identity management solution.
  21. Upcoming security changes to Google's OAuth 2.0 authorization endpoint in embedded webviews- Google Developers BlogThis post announces upcoming security changes to Google's OAuth 2.0 authorization endpoint when accessed via embedded webviews. To enhance security and prevent certain types of attacks, Google will be blocking embedded webview flows for OAuth 2.0 authorization. This change aims to improve user security by ensuring that authorization flows occur in a full browser context, which offers better protection against phishing and other malicious activities. Developers will need to update their applications to use a full browser tab or an external browser for OAuth flows.
  22. Announcing OAuth-based App Flip for Actions - Google Developers BlogIntroduces OAuth-based App Flip for Actions, allowing users to securely authenticate with their Google account to trigger actions on Google Assistant. This feature simplifies the user experience by enabling a seamless transition from the Assistant to the app, leveraging OAuth for authorization without requiring users to manually log in within the app.
  23. More granular Google Account permissions with Google OAuth and APIs- Google Developers BlogIntroduced more granular OAuth scopes for Google Account permissions, enabling developers to request specific access levels (e.g., read-only access to specific profile fields) instead of broad permissions. This enhances user privacy and security by limiting the data applications can access.
  24. Increased account security via OAuth 2.0 token revocation- Google Developers BlogIntroduced the ability to revoke OAuth 2.0 tokens, allowing users to revoke access for specific applications and thereby increasing account security.
  25. Modernizing OAuth interactions in Native Apps for Better Usability and Security- Google Developers BlogThis post details how to modernize OAuth interactions in native applications by implementing the Authorization Code Grant with PKCE flow. This approach enhances security by preventing authorization code interception and improves usability by allowing users to stay logged into their native apps without being redirected to a browser for every authorization request. It also covers the implementation of token refresh mechanisms to maintain user sessions.
  26. Saying goodbye to OAuth 1.0 (2LO) - Google Developers BlogThis post announces the deprecation of OAuth 1.0 (also known as 2-legged OAuth or 2LO) for Google APIs. OAuth 1.0 is being retired to improve security and simplify the authentication process for developers. Developers are strongly encouraged to migrate to OAuth 2.0, which offers enhanced security features and a more streamlined authorization flow. The deprecation will occur in phases, with full retirement planned for April 2017. This change aims to align with industry best practices and provide a more robust and secure authentication mechanism for accessing Google services.
  27. Easier Auth for Google Cloud APIs: Introducing the Application Default Credentials feature.- Google Developers BlogIntroduces Application Default Credentials (ADC) for Google Cloud APIs. ADC simplifies authentication by automatically discovering credentials based on the environment (e.g., GCE, GKE, local development with `gcloud auth application-default login`). This reduces the need for manual credential management and improves security by allowing applications to run with the least privilege necessary.
  28. Introducing the Google Identity Platform- Google Developers BlogIntroduced the Google Identity Platform, a unified platform for managing user identities across Google services. This platform aims to simplify identity management for developers and provide a more consistent user experience. It builds upon existing identity solutions and offers enhanced security and flexibility.
  29. A final farewell to ClientLogin, OAuth 1.0 (3LO), AuthSub, and OpenID 2.0 - Google Developers BlogThis post announces the deprecation and eventual removal of several older authentication protocols: ClientLogin, OAuth 1.0 (3LO), AuthSub, and OpenID 2.0. It guides developers to migrate to OAuth 2.0 and OpenID Connect for new applications and to update existing applications to use the newer protocols. This marks a significant step in standardizing Google's authentication infrastructure towards more secure and modern standards.
  30. Retiring the Email Migration API- Google Developers BlogThis post announces the retirement of the Email Migration API, signaling a shift away from older methods of email data access and migration. This implies a move towards more modern and secure authentication protocols for accessing email services, aligning with the broader theme of federated login and identity management.
  31. New features in Admin SDK: Custom user attributes, and opening up access to all domain users- Google Developers BlogThis post introduces two key enhancements to the Admin SDK: custom user attributes and expanded access to all domain users. Custom user attributes allow for more granular and flexible user data management, enabling developers to store and retrieve specific information relevant to their applications. The expansion of access to all domain users simplifies management for administrators and developers by removing previous limitations on which users could be accessed via the SDK. These features aim to improve the flexibility and power of identity management within Google Workspace.
  32. New Security Measures Will Affect Older (non-OAuth 2.0) Applications - Google Developers BlogThis post announces the deprecation of older authentication methods (non-OAuth 2.0) for Google APIs, emphasizing the security benefits and broader compatibility of OAuth 2.0. It provides a timeline for the deprecation and directs developers to resources for migrating their applications.
  33. Improving the Google Calendar API- Google Developers BlogThis post announces improvements to the Google Calendar API, focusing on enhanced functionality and developer experience. It highlights new features and refinements that make it easier for developers to integrate Google Calendar into their applications, thereby contributing to the broader ecosystem of integrated services and developer tools.
  34. Google+ Sign-In improvements- Google Developers BlogThis post announces improvements to Google+ Sign-In, focusing on enhanced security and a more streamlined user experience. It highlights the introduction of new features and refinements to the sign-in flow, aiming to make it easier and safer for users to connect their Google accounts to third-party applications. The improvements include better handling of user permissions and a more robust authentication process.
  35. Making Google’s CalDAV and CardDAV APIs available for everyone- Google Developers BlogThis post makes Google's CalDAV and CardDAV APIs publicly available, enabling broader access to Google Calendar and Google Contacts data through standard protocols. This democratizes access for developers and users, fostering interoperability with third-party applications.
  36. Adding OAuth 2.0 support for IMAP/SMTP and XMPP to enhance auth security- Google Developers BlogThis post announces the addition of OAuth 2.0 support for IMAP/SMTP and XMPP protocols, enhancing authentication security for Google services. This allows applications to access user data via these protocols using OAuth tokens instead of traditional username/password credentials, improving security and user control.
  37. OAuth 2.0 Playground and Google Drive API- Google Developers BlogIntroduced the OAuth 2.0 Playground, a web-based tool that allows developers to test OAuth 2.0 authorization flows with Google APIs, specifically demonstrating its use with the Google Drive API. This provides a hands-on way for developers to understand and implement OAuth 2.0 for accessing Google services.
  38. OAuth 2.0 Playground: new features- Google Developers BlogThe OAuth 2.0 Playground has been updated with new features to facilitate testing and development of OAuth 2.0 integrations. This includes improved usability for selecting scopes, making API calls, and inspecting responses, as well as enhanced support for various Google APIs.
  39. Service Accounts have arrived- Google Developers BlogIntroduced Service Accounts as a new method for applications to authenticate with Google APIs, allowing them to access user data without requiring user interaction. This enhances security and enables server-to-server communication.
  40. Simplifying Access Control in Google Cloud Storage- Google Developers BlogThis post introduces fine-grained access control for Google Cloud Storage, allowing developers to manage permissions at a more granular level. It highlights the use of OAuth 2.0 for authorizing access to Cloud Storage resources, simplifying the process for developers and enhancing security. This represents a significant step in making cloud storage more accessible and manageable for applications.
  41. Google APIs Client Library for Java: now with OAuth 2.0- Google Developers BlogThis post announces the integration of OAuth 2.0 into the Google APIs Client Library for Java. This is a significant step in simplifying and standardizing the process for developers to securely access Google APIs on behalf of users, building upon previous OAuth implementations.
  42. Best Practices for User Authentication- Google Developers BlogThis post introduces best practices for user authentication, focusing on secure password management, session management, and the importance of using secure protocols like HTTPS. It emphasizes the need for developers to implement robust authentication mechanisms to protect user data and prevent unauthorized access.
  43. Improving the security of Google APIs with SSL- Google Developers BlogThis post announces the mandatory use of SSL for all Google API requests, significantly enhancing the security of API interactions and protecting user data in transit. It marks a crucial step in solidifying the security posture of Google's developer platform and promoting best practices for secure API usage.
  44. Making auth easier: OAuth 2.0 for Google APIs- Google Developers BlogThis post announces the release of OAuth 2.0 as the new standard for Google APIs, replacing the older AuthSub and OAuth 1.0. It highlights the benefits of OAuth 2.0, including improved security, simplified authorization flows, and better support for mobile and desktop applications. The post provides guidance on migrating existing applications to OAuth 2.0 and introduces new libraries and tools to facilitate this transition.
  45. New OAuth support for Google Apps APIs- Google Developers BlogThis post announces the expansion of OAuth support to include Google Apps APIs, enabling secure access to user data for applications beyond Gmail. This marks a significant step in broadening the scope of programmatic access to Google services.
  46. OAuth access to IMAP/SMTP in Gmail- Google Developers BlogThis post announces the availability of OAuth access for IMAP and SMTP in Gmail, allowing third-party applications to securely access user email data. This marks an early step in providing programmatic access to Google services beyond basic authentication.
  47. Flashy New Authentication: AuthSub Adds Support for ActionScript- Google Developers BlogThis post announces the addition of ActionScript support to AuthSub, Google's authentication service. This integration allows Flash applications to authenticate with Google services using OAuth, expanding the reach of OAuth to client-side Flash applications and enabling them to access Google data.
  48. OAuth Enhancements- Google Developers BlogThis post announces the release of OAuth 2.0, a new authorization protocol that aims to simplify and secure access to user data across various applications and services. It highlights the benefits of OAuth 2.0 over previous protocols, such as improved security, flexibility, and ease of implementation for developers. The post also provides initial guidance and resources for developers looking to adopt OAuth 2.0 for their applications.
  49. Google Apps + OpenID = identity hub for SaaS- Google Developers BlogThis post announces the integration of Google Apps with OpenID, enabling Google Apps to act as an identity hub for SaaS applications. This allows users to log in to third-party services using their Google Apps credentials, simplifying identity management for both users and administrators. It highlights the potential for a unified identity experience across various SaaS offerings.
  50. Gmail for Mobile HTML5 Series: Autogrowing Textareas- Google Developers BlogThis post contributes to the feature thread by detailing specific techniques for building more responsive and engaging web applications for mobile devices, specifically focusing on the 'autogrowing textareas' feature within the Gmail for Mobile HTML5 Series. This highlights advancements in client-side development for richer user experiences on mobile platforms.
  51. Gmail for Mobile HTML5 Series: Using Timers Effectively- Google Developers BlogThis post contributes to the thread by demonstrating how to leverage HTML5 features, specifically timers, within the context of Gmail for Mobile. This showcases advancements in building more responsive and engaging mobile web applications, aligning with the broader theme of enabling richer web experiences through developer tools and platforms.
  52. Gmail for mobile HTML5 Series - Part 3: Using AppCache to Launch Offline- Google Developers BlogThis post introduces the use of AppCache (Application Cache) within the Gmail for mobile HTML5 series. AppCache allows web applications to store resources locally, enabling them to function offline and load faster. This directly contributes to the thread's theme of enabling richer, more accessible web applications by providing offline functionality.
  53. Gmail for mobile HTML5 Series - Part 2: Using AppCache to Launch Offline- Google Developers BlogThis post introduces the use of AppCache to enable offline functionality for Gmail on mobile devices, a key step in building robust and accessible web applications that can function without a constant network connection. This builds upon earlier efforts to provide developers with tools for richer web applications.
  54. Gmail for mobile HTML5 Series: Using AppCache to Launch Offline - Part 1- Google Developers BlogThis post introduces AppCache as a core HTML5 technology for enabling offline functionality in mobile web applications, exemplified by its use in Gmail for mobile. This directly contributes to the theme of providing developers with tools for richer web applications by enabling offline access, a crucial aspect of modern web development.
  55. Introducing the Gears Geolocation API for all laptop WiFi users- Google Developers BlogThis post introduces the Gears Geolocation API, a significant expansion of Google Gears that provides developers with a standardized method to access location data from laptop WiFi networks. This enables the creation of location-aware applications, enhancing the capabilities of web applications beyond offline access.
  56. Zoho Mail goes offline with Gears- Google Developers BlogThis post highlights Zoho Mail's adoption of Google Gears for offline access, showcasing how Google's technologies can enable richer, more integrated web applications. This indirectly supports the broader ecosystem of identity and access management by providing foundational tools for offline functionality and enhanced user experiences.
  57. Code Review: OAuth, Indexing Flash, Protocol Buffers, Selenium Ice, and more- Google Developers BlogThis post discusses the ongoing development and application of OAuth, a protocol for delegated authorization, within Google's services. It highlights its use in enabling secure access to user data for various applications and services, including IMAP/SMTP in Gmail and Google Apps APIs. The post also touches upon the broader context of identity management and access control.
  58. OAuth Available for Google Data APIs- Google Developers BlogThis post announces the availability of OAuth for Google Data APIs, enabling developers to grant third-party applications access to user data without sharing user credentials. This marks a significant step in enhancing security and user control over data access.