---
title: Orchestrator Evals
emoji: 📊
colorFrom: purple
colorTo: green
sdk: docker
app_port: 7860
pinned: false
---

# Orchestrator Evals with Google OAuth

This Space uses a lightweight FastAPI + Gradio app with Google OAuth.

## 1) Set Space secrets

In your Space Settings, add these secrets:

- `GOOGLE_CLIENT_ID`
- `GOOGLE_CLIENT_SECRET`
- `SECRET_KEY` (long random string)

## 2) Google Cloud OAuth setup (exact URLs)

OAuth client type must be **Web application**.

### Authorized JavaScript origins

- `https://ai71ai-orchestrator-evals.hf.space`
- `https://localhost:7860`
- `https://127.0.0.1:7860`

### Authorized redirect URIs

- `https://ai71ai-orchestrator-evals.hf.space/auth`
- `https://localhost:7860/auth`
- `https://127.0.0.1:7860/auth`

Important:

- URLs must match exactly (`https`, hostname, and `/auth` path).
- Do not add a trailing slash after `/auth`.

## 3) Local development

Install dependencies:

```bash
uv sync
```

Run locally:

```bash
uv run uvicorn app:app --host 0.0.0.0 --port 7860 --reload
```

Then open:

- `https://localhost:7860`

## 4) Docker Space notes

- The Space is built from `Dockerfile` and served on port `7860`.
- Runtime secrets are injected from Space Settings as environment variables.
- Keep OAuth secrets in Space Settings only (not in committed files).

## 5) App routes

- `/` - home/login status
- `/login` - starts Google OAuth
- `/auth` - OAuth callback URL
- `/gradio` - protected Gradio UI
- `/logout` - clears session
- `/health` - health check

## Notes

- On Hugging Face, `SPACE_HOST` is used to build the callback URL automatically.
- For local dev, the app upgrades localhost callback URLs to `https` for Google OAuth compatibility.