Sunday Coffee & Code: Google OAuth, Three Models, One Working App

𝗦𝘂𝗻𝗱𝗮𝘆 𝗖𝗼𝗳𝗳𝗲𝗲 & 𝗖𝗼𝗱𝗲: 𝗚𝗼𝗼𝗴𝗹𝗲 𝗢𝗔𝘂𝘁𝗵, 𝗧𝗵𝗿𝗲𝗲 𝗠𝗼𝗱𝗲𝗹𝘀, 𝗢𝗻𝗲 𝗪𝗼𝗿𝗸𝗶𝗻𝗴 𝗔𝗽𝗽

Grab your coffee - this week mixed ”learn something new” with ”watch three AI models handle parts of the same job very differently”. (It was a long day today.)

𝗧𝗵𝗲 𝗴𝗼𝗮𝗹: learn what it takes to bolt Google OAuth onto a 𝘚𝘵𝘳𝘶𝘤𝘵𝘶𝘳𝘦𝘥 Vibe Coded app - not loose prompt-and-pray coding, but one built on a real contract (BUILD-CONTRACT.md, Gherkin requirements and Expand-Migrate-Contract migration). Point a model at real OAuth and a real deployment, and see if the scaffolding holds.

𝗧𝗵𝗲 𝗯𝗮𝗸𝗲-𝗼𝗳𝗳:

• 𝗙𝗮𝗯𝗹𝗲 got the job done but burned through tokens fast enough that I was sitting around waiting for a reset.
• 𝗢𝗽𝘂𝘀 𝟰.𝟴 picked up next - and spent 𝟮𝟯% 𝗼𝗳 𝘁𝗵𝗲 𝘀𝗲𝘀𝘀𝗶𝗼𝗻 just re-orienting before writing a line of code.
• 𝗦𝗼𝗻𝗻𝗲𝘁 𝟱 took over from there and just worked: fast, efficient, seemingly no re-orientation tax, finished the build and chased down every bug without burning the budget.

While mostly anecdotal, if you’re picking a model for a long build with real infrastructure stakes, that efficiency is a consideration not just which model 𝘤𝘢𝘯 do the work, but which one gets out of its own way.

𝗧𝗵𝗲 𝗯𝘂𝗶𝗹𝗱: this app pulls fitness step data from the new Google Health API and putting real control in front of it, in three layers:

• 𝗔𝗰𝗰𝗲𝘀𝘀 - Vercel firewall, obviously.
• 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 - Sign in with Google OAuth
• 𝗔𝘂𝘁𝗵𝗼𝗿𝗶𝘇𝗮𝘁𝗶𝗼𝗻 - a new email allow-list controlling who’s actually let in, not just proving identity

Getting there meant chasing down some genuinely satisfying bugs:

• A redirect_uri_mismatch traced to a missing entry in Google Cloud Console - a missing call-back uri.
• A deployment that built clean but crashed every request with `ModuleNotFoundError:’ Good old dependencies to deal with.
• Sign-out that silently didn’t sign anyone out - a cookie-deletion header mis-match.

𝗪𝗵𝗲𝗿𝗲 𝗶𝘁 𝗹𝗮𝗻𝗱𝗲𝗱: a working app - sign in with Google, connect your health data, see your (once-FitBit, now Google Health) steps by day. The integration’s cleanly isolated behind its own module, so the next metric - heart rate, sleep, whatever comes next - should be a small, contained change.

𝗔 𝗴𝗼𝗼𝗱 𝗦𝘂𝗻𝗱𝗮𝘆. 𝗖𝗼𝗳𝗳𝗲𝗲’𝘀 𝘀𝘁𝗶𝗹𝗹 𝘄𝗮𝗿𝗺.