Google OAuth 2.0 PKCE flow in a React/Next.js app — no backend, no client secret

If you've tried to add Google OAuth to a SPA or a Next.js app, you've probably run into the same friction: Google's documentation is comprehensive but dense, most tutorials are incomplete, and the parts that matter most — like exactly why you need PKCE, or what access_type=offline actually does — are buried. This is the walkthrough I wish had existed when I built the auth layer for OvertimeIQ . By the end you'll understand: Why PKCE exists and why it's the correct flow for SPAs How to implement