Sign-in setup

Each way in can be turned on independently. Any one of them is enough to sign in; the approval queue applies to all of them alike.

1. Create an OAuth client
In Google Cloud Console → APIs & Services → Credentials → Create credentials → OAuth client ID → Web application.

2. Add the redirect URI

https://studio.argu.cloud/api/auth/callback/google

3. Put the credentials in .env.local

AUTH_GOOGLE_ID=<client id>
AUTH_GOOGLE_SECRET=<client secret>
AUTH_SECRET=<run: npx auth secret>
NEXTAUTH_URL=https://studio.argu.cloud

.env.local is gitignored — these never reach the repository.

Or: email codes instead of Google
Set one provider key and people sign in with a 6-digit code emailed to them. The same approval queue applies either way.
Mailjet is the one to pick if you can't edit the domain's DNS — it verifies a single sender address by emailing it a confirmation link. Add the address under Senders & Domains, wait for it to read Active, then use it as the from.
```
MAILJET_API_KEY=xxxxxxxx
MAILJET_SECRET_KEY=xxxxxxxx
ARGU_FROM_EMAIL=Argu AI <verified@your-domain>
```
Or Resend — fastest to start, but its onboarding sender only delivers to the account owner's own address. Reaching anyone else needs a DNS-verified domain.
```
RESEND_API_KEY=re_xxxxxxxx
```
Or SendGrid — the sender address must be verified there first, or mail bounces.
```
SENDGRID_API_KEY=SG.xxxxxxxx
ARGU_FROM_EMAIL=Argu AI <no-reply@argu.ai>
```
4. Restart the dev server
First sign-in from nadav@tipping-point.ai or prod@argu.ai or benny@argu.ai is auto-approved as an admin. Everyone else lands as pending for you to approve.