Marketing Manager uses Google sign-in with an explicit allowlist. Consumer manifest reads and Auth.js callback routes stay public.
Sign in to access Reviews, Locations, Updates, Intake, and Translations. The session cookie is host-only and scoped to this Marketing Manager app.
Gated paths: every operator route except /auth/* and /api/usage-manifest.json.