Fix guides / Google login: "Error 400: redirect_uri_mismatch"

How to fix "Error 400: redirect_uri_mismatch" on Google sign-in

You click Sign in with Google and instead of the account picker you get a Google page saying Access blocked: This app's request is invalid, Error 400: redirect_uri_mismatch. Nothing in your app code is wrong. Two allow lists, one in Google Cloud and one in Supabase, do not match the URL being used.

Symptoms

• Google shows Error 400: redirect_uri_mismatch right after clicking the button.
• It works on one URL (often localhost or the builder preview) but not on your deployed domain, or the other way round.
• The error details mention a redirect_uri that ends in /auth/v1/callback.

How the redirect actually works

With Supabase Auth, Google never sends the user straight back to your app. The flow is: your app, then Google, then Supabase (https://YOUR-PROJECT-REF.supabase.co/auth/v1/callback), then your app. Google checks the Supabase callback URL against the list you saved in Google Cloud. Supabase then checks your app URL against its own Redirect URLs list. A mismatch in the first list gives redirect_uri_mismatch. A mismatch in the second usually sends users to the wrong place (often localhost) instead.

Step 1: find your exact callback URL

In Supabase open Authentication, then Sign In / Providers, then Google. The page shows the Callback URL (for OAuth). Copy it exactly. It looks like:

https://abcdefghijklmnop.supabase.co/auth/v1/callback

If you use a Supabase custom domain, the callback uses that domain instead. Use whatever the provider page shows.

Step 2: add it in Google Cloud

1. Open Google Cloud Console, then APIs and Services, then Credentials.
2. Open the OAuth 2.0 Client ID whose Client ID is pasted into Supabase. Projects often have several; check the ID matches.
3. Under Authorized redirect URIs, add the Supabase callback URL from Step 1. No trailing slash, no extra spaces, https not http.
4. Under Authorized JavaScript origins, add your app origins, for example https://myapp.com and http://localhost:5173.
5. Save. Changes can take a few minutes to apply.

Step 3: fix the Supabase side

In Supabase open Authentication, then URL Configuration:

• Site URL: your production URL, for example https://myapp.com.
• Redirect URLs: every place you sign in from, for example https://myapp.com/**, https://*.vercel.app/** for previews, http://localhost:5173/**.

Then send users back to the current site explicitly:

await supabase.auth.signInWithOAuth({
  provider: 'google',
  options: { redirectTo: `${window.location.origin}/auth/callback` },
});

Still failing?

• Wrong client. The Client ID and secret in Supabase belong to a different OAuth client than the one you edited.
• Using the builder's managed Google login. Some builders (for example Lovable Cloud) offer a managed Google sign-in. If you switched to your own Google credentials, the managed settings no longer apply and you must do Steps 1 to 3 yourself.
• Consent screen in Testing mode. That gives a different error (access blocked for users not on the test list), fixed by adding test users or publishing the app in the OAuth consent screen settings.

Last updated 2026-10-19.