Google Plus停用：已实现的OAuth 2.0登录流程技术咨询

Let’s walk through each of your concerns step by step—this is a super common issue with legacy Google OAuth setups, so I’ve got you covered:

Q1: Will the OAuth 2.0 flow still work normally after Google Plus is shut down? #

Yes, but with an important caveat. Your core login flow using openid and email scopes will keep working perfectly—those are part of the OpenID Connect standard and have nothing to do with Google Plus. The only problem comes if your code relies on data or APIs tied to the plus.me scope (like pulling Plus-specific profile data or social features). If you’re just using OAuth to authenticate users and grab their email, the flow itself won’t break, but you still need to remove plus.me to avoid errors once it’s fully deprecated.

Q2: Do we need to replace the https://www.googleapis.com/auth/plus.me scope to keep our OAuth 2.0 flow and code intact? If so, how do we prevent Google from automatically adding this scope? #

You absolutely need to replace or remove this scope—once Plus is shut down, plus.me will stop working entirely, and any dependencies on it will cause failures. Here’s how to fix this:

First, replace it with supported scopes: #

If you need basic user info, openid profile email covers everything you’re likely getting from plus.me (email address, basic profile details like name). These scopes are stable and won’t be deprecated.

To stop Google from auto-adding plus.me: #

• Explicitly define your scopes in the OAuth request: The #1 reason plus.me gets added automatically is if you’re not specifying scopes at all in your auth call. Make sure your code sends a scope parameter with exactly what you need (e.g., scope=openid email), instead of leaving it blank. Old OAuth libraries often defaulted to adding plus.me when no scope was set.
• Clean up your Google Cloud Console settings: Head to your OAuth consent screen and client configuration. Remove any default Plus-related scopes that might be enabled there—some older client setups had these pre-selected automatically.

Q3: We’re worried about the plus.me scope—how can we control or prevent it from being auto-added? Should we just do nothing and let Google handle it before the shutdown? #

Don’t wait for Google to fix this for you—take action now. While Google might stop returning the plus.me scope eventually, relying on that could lead to unexpected issues in the meantime (like error messages during auth, or users seeing outdated consent prompts).

Stick to the steps from Q2: explicitly set your desired scopes, clean up your Cloud Console settings, and test your auth flow to confirm plus.me no longer shows up in the returned scope list. This ensures your flow stays stable both now and after the Plus shutdown.

内容的提问来源于stack exchange，提问作者Jaymit