How customers get into the customer portal. Two sections, from two modules, so a person may see one and not the other.
Customer sign-in (Google)
Google is the only provider here. Fields: client ID, client secret and Enabled (a text box where you type true or false). All three are required each time you save. Needs Manage domains and credentials.
The section lists a redirect address for each active domain (https://<domain>/api/portal/auth/google/callback). Register every one in your Google Cloud project; Google matches them exactly. After adding a domain, come back and register its address.
Removing the credentials is guarded. If customers have signed in with Google, you must acknowledge how many would be locked out before the removal goes through.
Portal access (from CRM)
One checkbox: Ask customers without an email to add one, with a Save button. Below it, status rows show whether email codes and SMS codes can actually be sent (email needs a mail sender; SMS needs an SMS provider).
If neither works, a red banner says nobody can sign in. Fix it on the Email and SMS tabs. Needs permission to edit customers.
A person with only the credentials permission does not see this tab's CRM section, and a CRM editor does not see Google sign-in: each section checks its own permission.
Not the same as Social OAuth
Social OAuth (on the Social tab) is for posting to your accounts. This is for customers signing in.