Google clients are OIDC providers: when the scope includes openid, the token response includes an id_token — the same conditions as real Google. Everything else follows the shared OAuth Flow.
ID tokens
Section titled “ID tokens”Google clients issue an ID token with the same fixed claim set as real Google: iss, azp, aud, sub, email, email_verified (boolean), at_hash, nonce (echoed from the authorization request), name, picture, given_name, family_name, locale, iat, exp, jti.
No custom claims are ever added — you can’t inject claims into a Google-issued token in reality, so the mock doesn’t allow it either. Identity claims set on a google client are rejected with a 400 (see Clients & Identities).
Token response
Section titled “Token response”The token response returns token_type: "Bearer" and includes expires_in (3600), as real Google does. The code is exchanged with a form-encoded POST to the token endpoint.
Fetching the user profile
Section titled “Fetching the user profile”Google clients serve the standard /oauth/userinfo endpoint — call it with the access token as a Bearer token.
PKCE (S256) is optional for Google clients, as it is with real Google.