cmueats uses Google as its identity provider, meaning that the sign in button on cmueats is really just a “sign in with Google.”
Since we want to gatekeep the review system to CMU students only, we restrict Google accounts to those ending in *.cmu.edu. Even better, we can actually bypass the Google account picker screen by passing in hd: "[andrew.cmu.edu](<http://andrew.cmu.edu/>)" (or cmu.edu) when sending an authentication request to https://accounts.google.com/. (Thanks ScottyPass for the idea!) From internal testing, this bypass works on Chrome and Safari but doesn’t work in Cursor’s browser. We have not yet verified if users that only have a @cmu.edu email can log in fine. (However, given that this kind of thing has been implemented in ScottyPass for all these years, it’s likely to work.) Another con is that if you have two cmu accounts (for whatever reason), switching between them is a bit of a hassle - you need to both sign out on https://accounts.google.com AND clear cookies on login.cmu.edu. Just signing out of your google account won’t work, as you’ll just get re-logged into the same account on CMU’s side.
This is what we get in Cursor’s browser. Not entirely a dealbreaker, but if someone only has an @cmu.edu email, they’ll be rather confused.
For more details on the authentication flow, refer to the following RFC: (see the Login Flow section)
The relevant ENV variables are OIDC_SERVER, OIDC_CLIENT_ID, and OIDC_CLIENT_SECRET
Log into Google Cloud with [email protected]. (password is in the Vault). Find the Google Oauth project, and click the ScottyLabs client.
As of May 2026, here are the authorized redirect URIs. If you wish to obtain the client secret, just check either the prod or staging deployment in Railway.
