Code's shipped to the repo (`3aa5026`) and your local `marlin` is 0.1.8. Now your part — the credentials (≈10 min), then we test live and I publish.

## Config checklist

**1 · Google Cloud — create the OAuth client** ([console.cloud.google.com](https://console.cloud.google.com))
- New (or existing) project → **APIs & Services → OAuth consent screen** → External → app name `marlin`, your support email. Scopes: just **email + profile** (non-sensitive → no Google verification needed). Add yourself under **Test users**.
- **APIs & Services → Credentials → Create credentials → OAuth client ID → Web application.**
- **Authorized redirect URIs →** add exactly:
  `https://iqjjodhgoohixngrlqaf.supabase.co/auth/v1/callback`
- Copy the **Client ID + Client Secret.**

**2 · Supabase — enable Google** (your project dashboard)
- **Authentication → Providers → Google →** enable, paste the Client ID + Secret, save.
- **Authentication → URL Configuration → Redirect URLs →** add:
  `http://localhost:54123`  ← the CLI's fixed redirect

**3 · Test it here** (your local 0.1.8)
```bash
marlin login          # browser opens → Sign in with Google → "✓ signed in as you@…"
```
Then check **Supabase → Authentication → Users** — your email should be there. That's the lead captured.

**4 · Once that works**, I'll: publish 0.1.8 to PyPI · **ungate the HF weights** (your 1-click: the repo's Settings → turn gating off) so downloads need no HF account · and strip the now-dead `auth_check`/`gated_notice` code.

Two notes: while the Google consent screen is in **"testing"** mode only your added test users can sign in — publish it (no verification needed for email/profile) before launch. And once Google is on, `marlin setup` will start showing the "Sign in with Google?" prompt automatically (it's gated on the provider being live).

Ping me when Google's enabled and I'll watch the `marlin login` round-trip with you, then ship.