Google OAuth Connector
The Google connector enables "Sign in with Google" on the Kiwire captive portal and enterprise WiFi. Guests and employees authenticate using their existing Google or Gmail account — there is no need to create a separate Kiwire password.
'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}public/assets/img/docs/connector-google/overview.png
Use Cases
- Guest hotspot — Any visitor with a Google or Gmail account can log in instantly using the familiar Google sign-in flow.
- Google Workspace organisations — Restrict access to accounts belonging to your
organisation's Google Workspace domain (e.g.
@yourcompany.com). - Education — Schools using Google Workspace for Education can give students and staff WiFi access using their school Google accounts.
Google Cloud Console Setup
Create OAuth 2.0 credentials in the Google Cloud Console before configuring the connector in Kiwire.
In the Google Cloud Console, create a new project (e.g. "Kiwire WiFi") or select an existing one. All credentials will be scoped to this project.
Go to APIs & Services → Library and enable the Google People API (used to retrieve the user's name and email after login).
Go to APIs & Services → OAuth consent screen. Choose External for a public guest portal or Internal for Google Workspace-only access. Fill in the app name, support email, and authorised domains.
Go to APIs & Services → Credentials → Create Credentials → OAuth client ID. Select Web application as the application type.
In the Authorised redirect URIs section, add the callback URL shown in Kiwire's
connector settings. It follows the format:
https://your-kiwire-domain.com/admin/oauth/google/callback
Click Create. A dialog shows your Client ID and Client Secret. Copy both into the Kiwire connector form and save.
The redirect URI in Google Cloud Console must match the Kiwire callback URL exactly,
including the scheme (https://) and any trailing paths. A mismatch will cause a
redirect_uri_mismatch error when users attempt to log in.
public/assets/img/docs/connector-google/cloud-console-credentials.png
Configuration Fields
| Field | Description |
|---|---|
client_id | OAuth 2.0 Client ID from Google Cloud Console |
client_secret | OAuth 2.0 Client Secret from Google Cloud Console |
redirect_uri | OAuth callback URL — shown in Kiwire; must be added to Google Cloud Console exactly as shown |
Domain Restriction
To restrict access to a specific Google Workspace domain, enable Domain Restriction
in the connector's advanced settings and enter your domain (e.g. yourcompany.com).
Kiwire will check the hd (hosted domain) claim in the Google ID token. Users signing in
with a personal Gmail account will be denied with a clear error message.
Domain restriction adds a client-side check via the hd parameter on the authorisation
request. For stronger enforcement, also check group membership in your Google Workspace Admin console
and set the OAuth consent screen to Internal.
Auto-Registration
On a user's first login via Google, Kiwire automatically creates a WiFi account using the user's Google email address as the username. The account is assigned the access profile configured on the connector instance. Subsequent logins reuse the same account.
Profile Picture
When enabled in the connector advanced settings, Kiwire fetches the user's Google profile picture URL from the People API and stores it against the user's account. The picture is displayed in the admin portal's user detail view and can optionally be shown on the captive portal success page.
Profile pictures are stored as URLs (not downloaded to Kiwire's storage). If a user removes their Google profile picture, the stored URL will return a 404 — this is cosmetic only and does not affect authentication.
Required Permissions
view-connector-google · edit-connector-google