Google Login & One Tap for OpenCart

Overview

Google Login & One Tap lets shoppers sign in and register with their Google account: a "Continue with Google" button on the login, register and checkout pages, and the Google One Tap prompt on storefront pages.

• Buttons where people sign in. On the login page, the register page and the checkout for signed-out shoppers, in Google colours, outline or icon only, three shapes, above or below the login form. In narrow columns the label shortens to "Google".
• Google One Tap. The Google account prompt for signed-out shoppers on storefront pages, with optional automatic sign-in for returning customers.
• Safe account matching. An e-mail that Google confirmed connects to the existing customer with that e-mail; otherwise the account password is asked once. New customers get an account with their name and e-mail.
• Connected accounts. Customers see their connected Google account in their account and can disconnect it once they have a password.
• Security. Authorization code flow with state, nonce and PKCE, Google ID tokens verified against Google's keys (issuer, audience, expiry, nonce), browser binding, single-use states, client secret stored encrypted. Works with OpenCart 4's SameSite=Strict session cookie: the return from Google continues on your own site, so the cart and session are kept.
• Statistics. Sign-ins, new accounts, completion rate, One Tap share and the reasons why sign-ins failed, per day.
• Room to grow. Need Apple, Microsoft, Facebook or more later? Social Login Pro (sold separately) adds eight more providers; when you install it, it copies the Google keys and the connected accounts of this extension, and this extension steps back so shoppers never see two Google buttons.

No OCMOD, no core file edits. One licence covers OpenCart 4 and 3. Tested on OpenCart 4.1.0.4 and 3.0.5.1 with the default themes against a local mock of Google's sign-in endpoints (no real Google account was used); other 4.0.2.x to 4.1.x and 3.0.3.8 to 3.0.5.x versions are expected to work but are not tested. Themes that replace the login, register or checkout templates may need a different place for the button.

Installation

Requirements

• OpenCart 4.0.2.0 - 4.1.x or 3.0.3.8 - 3.0.5.x, PHP 7.4 or newer with the cURL and OpenSSL extensions.
• HTTPS on the live storefront: Google accepts only https redirect addresses for live sites.
• A Google Cloud project with an OAuth client ID of type "Web application" (free).

OpenCart 4

1. Extensions > Installer: upload kv_google_login.ocmod.zip and press the install button.
2. Extensions > Extensions > Modules: install Google Login & One Tap, then open it.

OpenCart 3

1. Extensions > Installer: upload kv_google_login-oc3.ocmod.zip.
2. Extensions > Modifications: press Refresh (the extension has no OCMOD changes; this only clears the cache).
3. Extensions > Extensions > Modules: install Google Login & One Tap, then open it.

The page is also under Customers > Google sign-in.

First steps

1. Google keys: press "Open the console" and follow the numbered steps: create the OAuth client ID, add the redirect URI shown on the page (Copy button) and your store address as an authorized JavaScript origin (needed for One Tap). Paste the client ID and client secret, tick "Show the button" and save.
2. Check settings asks Google for its sign-in configuration and tells you what is missing.
3. Settings: choose the pages, the button style and whether Google One Tap is on.
4. Enter your licence key in Settings (14-day trial without a key). Without a valid licence the storefront shows no button; the admin and the connected accounts stay.

Update

• OpenCart 4: Extensions > Installer, uninstall and delete the old upload, upload the new zip and install it. Do not uninstall the module under Extensions > Modules: that removes the keys and connected accounts.
• OpenCart 3: upload the new zip over the old one, then Modifications > Refresh.

Moving to Social Login Pro

Install Social Login Pro as usual. It copies the Google keys (when it has none of its own), the One Tap setting and every connected Google account of this extension. While Social Login Pro is switched on, this extension shows nothing on the storefront and says so on its admin page; you can then uninstall it. If you switch Social Login Pro off or remove it, this extension works again with its own data.

Uninstall

Extensions > Extensions > Modules > Uninstall removes the events, the settings and all data of the extension (Google keys, connected accounts, statistics). Customer accounts stay; customers who only used Google can set a password with "Forgotten password".

Configuration

Google keys

In the Google Cloud Console add the redirect URI shown on the page under "Authorized redirect URIs" and your store address under "Authorized JavaScript origins" (One Tap needs it). On the OAuth consent screen keep the scopes openid, email and profile.

Settings

• Status: on or off for the storefront.
• Show buttons on: login page, register page, checkout (signed-out shoppers).
• Button style: Google colours, outline or icon only. Shape: rounded, pill or square. Position: above or below the login form.
• Existing e-mail: connect automatically when Google confirmed the e-mail (default), or always ask for the account password once.
• New customers: create an account at the first sign-in, or only let existing customers sign in. New accounts get the default customer group; if that group needs approval, the shopper is told so and signs in after approval.
• Google One Tap and automatic sign-in for returning customers (not shown in the checkout).
• Keep statistics: days of the sign-in log (7 - 3650).
• License key (own-store edition).

Usage

For shoppers

1. A shopper clicks "Continue with Google" on the login, register or checkout page (or picks an account in the One Tap prompt) and approves at Google.
2. Back in the store the shopper is signed in and returns to the page they came from (the checkout stays the checkout).
   • Known Google account: signed in at once.
   • E-mail of an existing customer, confirmed by Google: the Google account is connected to that customer and signed in.
   • E-mail of an existing customer, not confirmed (or the store always asks): "Connect your account" asks the account password once.
   • New shopper: the account is created with the name and e-mail from Google. Without a confirmed e-mail or a name, "Almost done" asks for them first.
3. Account > Connected accounts shows the connected Google account. An account created by a Google sign-in keeps it as its only sign-in method until the customer sets a password with "Forgotten password"; then it can be disconnected.

For you

• Overview: sign-ins, new accounts, completion (button clicks that ended signed in), connected customers and problems for the last 7, 30 or 90 days, per day, with the latest activity, a setup checklist and the redirect URI.
• Why sign-ins failed: cancelled at Google, finished in another browser, link used twice, took too long, wrong password, Google not reachable, token problems and more, in plain words.
• Deleting a customer in the admin also removes their connection.

FAQ

Does it change core files or use OCMOD?

No. It works with OpenCart events only.

Can someone take over an account with a Google account that uses the same e-mail?

Only when Google confirmed that the shopper owns the e-mail. Without that confirmation the account password is asked once. You can also make the password step mandatory for every existing e-mail.

My store uses the SameSite=Strict session cookie (OpenCart 4 default). Does that matter?

No. The return from Google is a cross-site request, so the extension stores the answer, does not touch the session there, and continues on your own site, where the session cookie is sent again.

Do I need HTTPS?

For the live store, yes: Google accepts only https redirect addresses for live sites.

I also want Apple, Microsoft or Facebook. Social Login Pro (sold separately) has them. Installing it copies this extension's Google keys and connected accounts; this extension then steps back automatically, so there is never a second Google button or a second One Tap prompt.

What happens without a valid licence?

The storefront shows no button; the admin, the Google keys and the connected accounts stay.

Which themes work?

The default themes of OpenCart 4 and 3. Themes that replace the login, register or checkout templates may place the button differently.

Is it tested with a real Google account?

It is tested against a local mock of Google's authorization, token and key endpoints and with contract tests of the Google sign-in (ID token signature, issuer, audience, expiry, nonce, key rotation, One Tap credential). Check your keys with the "Check settings" button after setup.