I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods.
I'm basically treating the Google ID and Password as credentials here. I'm already one-way hashing passwords but I'm not sure if I need to go this extra length with Google ID's as well.
I followed the best practices outlined in Google's docs which include sending the JWT token signed by Google from the client to server, which is then verified and used to get the User ID (all on the server). So I'm not worried about someone potentially using a stolen User ID to get access to an account; however I'm a bit worried about possible compromises of the database and, if in that case, the User ID from Google should be encrypted.