Sign in with Google in Open Grind

Starting with v0.1.0-beta.2 it's possible to authenticate if your account in Grindr was created with Google.

Windows, Linux, macOS, iOS

Just download the app and tap "Sign in with Google" on the sign-in screen.

Android

Due to security checks by Google, you must install a Google OAuth add-on (recommended) or paste the sign in token manually.

Open Grind Google OAuth app (recommended)

1. Tap "Sign in with Google"
2. On the sign in screen, tap "Install" and confirm Android's install prompt; alternatively, install Google OAuth App manually
3. Tap "Continue", then follow the instructions

Installed from Google Play

Open Grind from Google Play can't install other apps, so install the add-on yourself:

1. Open Google OAuth App releases in your browser
2. Download the APK for your device and open it; Android asks your browser for permission to install apps once
3. Return to Open Grind, tap "Sign in with Google", then "Continue"

Or skip the add-on and paste the sign in token manually.

Manually paste Google OAuth token

If you already have Open Grind Google OAuth app installed, try these steps to retrieve Google OAuth token and put it into Open Grind manually:

1. Launch Open Grind Google OAuth app from your Android launcher or home
2. Tap the "Sign in with Google" button, then follow the instructions to sign in
3. You land on a page with your token masked. Tap "Copy token"
4. Go to Open Grind sign in with Google screen and tap "paste the OAuth token manually"
5. Paste the copied token and tap "Sign in"

If you have Firefox or Librewolf installed (Desktop/Android), Google Chrome or Chromium-based browsers (Desktop only, there are no extensions in Google Chrome for Android), you have an option to avoid using the Google OAuth app altogether.

1. Install the Grindr Google OAuth WebExtension in your browser
2. In the extensions list in the browser toolbar, click on the extension's icon
3. A new page should open with the "Sign in with Google" button — tap it, then follow the instructions to sign in
4. You land on a page with your token masked. Tap "Copy token"
5. Go to Open Grind sign in with Google screen and tap "paste the OAuth token manually"
6. Paste the copied token and tap "Sign in"

Why a separate app? (technical in-depth explanation)

This section answers some questions on why the decision to release a separate Google OAuth app for Android was made. It's intended for technical experts who have some knowledge of mobile development and are familiar with the OAuth protocol.

Full discussion: https://git.opengrind.org/open-grind/open-grind/issues/27

Why not the native Google OAuth flow?

The official Grindr app uses Google Identity Services installed on the Android device to authenticate user. This means the app calls host system's GIS, which checks both caller package id (which must be com.grindrapp.android and not org.opengrind, and setting latter to former would cause conflict errors for users who use both) and, more importantly, package signature (which is not possible to forge, since we don't hold Grindr's JKS; signature spoofing is only possible on some ROMs and rooted devices).

There is no way to launch native Google OAuth flow for Grindr's official app from a third-party client using the official Google Play Services.

Why not use microG or another free reimplementation?

MicroG itself does not allow spoofing, as it's a drop-in that works via the same APIs. YouTube ReVanced ships its own patched microG. However there's still a problem: native Google OAuth flow requires a DroidGuard token, which is obtained by executing a proprietary opaque blob generated by Google web API per-request inside of a proprietary opaque attestation VM requiring permissions to the device to validate it's a real physical device and not an emulator. DroidGuard VMs are completely obfuscated and reverse engineering attempts by microG developers failed. See microG discussion.

There is no way to complete native Google OAuth flow without having a real physical Android device and running proprietary opaque executables from Google. This defeats both cross-platform goal of Open Grind and full transparency.

Can we authenticate user with Google OAuth without native flow?

Yes, that's how web.grindr.com works. The entire authentication is web flow, meaning it's supposed to run in browsers, without requiring any device attestation tokens, so it's possible to run it on any platform, even in emulators. Web flow is launched from web.grindr.com with responseType=postMessage and the resulting code is posted by GIS JavaScript with web.grindr.com origin, so only pages with web.grindr.com origin can receive the callback. Additionally, browsers (even embedded ones) prevent actions such as opening new tabs without user gesture, which is why a tap is needed on the launch page.

However, there's another problem: Google OAuth Web Flow page checks aggressively for any signs of rendering the sign-in page in embedded windows (including system WebViews, which is what Tauri uses under the hood of Open Grind UI), and while changing User-Agent and removing Sec- headers is possible for both WebKit-based WebViews (WKWebView for macOS & iOS, WebKitGTK for Linux) and Chromium-based WebViews (WebView2 for Windows, Chromium for Android), Android's Chromium WebView specifically adds a special X-Requested-With header that's impossible to remove. This has been pushed by Google specifically for "fraud/abuse detection" (i.e. to detect Android WebView in their services, such as the OAuth page). In 2023 it was announced Google starts a trial to allow developers to opt-out of sending this header, but in 2025 the decision was reversed and X-Requested-With is now sent on all Android system's Chromium WebView requests with no option to disable it, which is exactly what triggers Google OAuth page "security checks" and rejects attempts to sign in.

All other platforms work just fine by rendering Google's OAuth page directly in platform's native WebView, so it's only an issue on Android.

Can we bundle a different WebView for Android?

There aren't many choices: for Android only Chromium WebView and Mozilla's GeckoView are available. While it's possible to bundle one with the Open Grind app, there are two practical concerns:

1. WebView libraries are massive. Chromium is 200+ MB, GeckoView is slightly lighter being ~100 MB.
2. Many users won't even need to ever sign in with Google, so adding 100MB+ to app size just to render one page isn't practical.
3. Additionally, publishing an app to F-Droid's official repository requires building every dependency from source, and building GeckoView takes hours even on powerful machines — this is why you don't see any apps with GeckoView in the F-Droid repository (except for browsers such as Fennec and Tor); also GeckoView includes Google Services, so we'd have to patch it before building from source

Each CPU architecture adds ~100MB to the universal bundle. So Open Grind apk grows from ~70MB to ~500MB just for one page used once only by some people.

Can we bundle GeckoView with Android app and render the app itself in it?

No, Tauri's wry only works with system's WebView (i.e., Chromium).

How do we solve all these issues?

To solve these Google OAuth issues, we've built the Grindr Google OAuth WebExtension. It's a browser extension (Firefox, any Firefox-based browser such as Librewolf, Firefox for Android, Google Chrome, Chromium, any Chromium-based browser such as Brave) that launches web.grindr.com (to satisfy the launch page's origin requirement), replaces document with a simple "Sign in with Google" button, then intercepts the response token from Google OAuth page before it hits Grindr Web's API and either shows it masked on a local page for copying, or passes it to GeckoView for programmatic intent.

So why build an app if it's an extension?

The whole app is basically a headless browser powered by GeckoView embedding the extension. The reason is simply that most Android users don't have Firefox and use Google Chrome for Android instead, which does not support extensions.

Also, the app features a programmatic intent, which allows the Open Grind app to call this app and get the token back automatically without copy-pasting. For security, this only works with official builds: Open Grind must be signed by Open Grind or installed from Google Play, and the Google OAuth app must be signed by Open Grind.

If you're an advanced user and prefer to avoid installing an unnecessary app, consider using the browser extension directly and copy-pasting the token into Open Grind app.