I wanted the normal Android Google sign-in for a Capacitor app: the system account picker, no browser tab, ending in a Supabase session. The flow is simple once it works. The picker gives you a Google ID token, and Supabase checks that token with signInWithIdToken .

Getting it working took longer than I expected. Most of the time went into Google Cloud setup, plus one bug in my own code that only showed up on a phone. Here's the setup that works, then the bug.

Stack: Capacitor 8, React, TypeScript, @supabase/supabase-js , and @capgo/capacitor-social-login 8.5.x.

1. Google Cloud: one Web client, and Android clients for each signing key

Put everything in one Google Cloud project.

OAuth consent screen. Choose External. While the app is in Testing mode, only accounts listed under Audience > Test users can sign in. If you test with a Google account that isn't on the list, sign-in fails. Add every account you plan to test with.

Web application client.…