Index: src/routes/admin-settings.js
===================================================================
--- src/routes/admin-settings.js	(revision 029f047c2a08e4991412f75369d040bee40c9c49)
+++ src/routes/admin-settings.js	(revision e2a8e313c3e2ab4e6c0b46dee342bf6b30e677c4)
@@ -23,4 +23,5 @@
 import { getTenancy, setTenancy, getSetting, setSetting } from '../services/SettingsService.js';
 import { entitlementStatus, premiumUnlocked } from '../services/PatreonService.js';
+import { googleConfigured, redirectUri, currentClientId, clientSecretSet } from '../config/google.js';
 
 const router = express.Router();
@@ -76,4 +77,10 @@
     hubHeroOverlay: clampOverlay(getSetting('hub_hero_overlay')),
     premium: entitlementStatus(),
+    google: {
+      configured: googleConfigured(),
+      redirectUri: redirectUri(),
+      clientId: currentClientId(),
+      secretSet: clientSecretSet(),
+    },
     success: req.query.success || null,
     error: req.query.error || null,
@@ -129,3 +136,18 @@
 });
 
+// Google-login (luisteraars) configureren — Client ID + Secret in app_settings.
+// De redirect-URI leiden we af van PUBLIC_BASE_URL (zie config/google.js).
+router.post('/google', requireGod, (req, res) => {
+  if (req.body.clear === '1') {
+    setSetting('google_client_id', '');
+    setSetting('google_client_secret', '');
+    return res.redirect('/admin/settings?success=' + encodeURIComponent('Google-login losgekoppeld'));
+  }
+  setSetting('google_client_id', (req.body.google_client_id || '').toString().trim());
+  // Secret alleen overschrijven als er een nieuwe waarde is ingevoerd (leeg = laat staan).
+  const secret = (req.body.google_client_secret || '').toString().trim();
+  if (secret) setSetting('google_client_secret', secret);
+  res.redirect('/admin/settings?success=' + encodeURIComponent('Google-login opgeslagen'));
+});
+
 export default router;