Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

Google login blocked with 403 disallowed_useragent when opened from Instagram bio

Open · 1021 views · asked by frankie_r · edited
lovableauthmobilesupabase

My app link is in my Instagram bio. People tap it, Instagram opens it in its own browser, they press 'Continue with Google' and Google shows

Access blocked: MyApp's request does not comply with Google's policies
Error 403: disallowed_useragent

Most of my traffic comes from Instagram and TikTok so this is a big deal. Is there a setting to allow it?

What I’ve tried

Looked in Google Cloud Console for a setting about webviews. Asked Lovable, it suggested changing the user agent, which I can't do in someone else's app.

Comment
Same problem here with TikTok traffic, following. aisha_m · edited

3 answers

ben_mobile · edited

No setting. Google deliberately blocks OAuth inside embedded browsers (webviews), because the host app could read the password. Instagram, TikTok, Facebook in-app browsers are exactly that.

What works:

  1. Detect the in-app browser and show a banner: 'Open in your browser for Google login' with instructions (the ... menu → Open in browser). User agents contain Instagram, FBAN/FBAV, or TikTok.
  2. Offer a login that works in webviews: email with a 6-digit code works fine there.

Some sites try tricks to force-open the system browser; on Android an intent:// link sometimes works, on iOS there's nothing reliable.

Comment
The banner + email code combo is what I'll do. A bit sad there's no real fix. frankie_r · edited
Same thing for Apple login in some webviews btw. Email code is the universal fallback. pixelpaulo · edited
dev_ana · edited

Also: put a landing page in your bio link rather than the login page. People who see content first and then tap 'Sign up' tend to have already opened the browser by then, or at least understand the banner.

Comment
lukas_b · edited

If you ever wrap this in a native app: use the native Google Sign-In SDK (or the system browser via ASWebAuthenticationSession / Custom Tabs), never a plain webview. Same policy, same 403.

Comment

Related

Magic link login fails only when people open the email on their phonesolved
Supabase Google login in Expo redirects to localhost:3000 and the app never gets the sessionsolved
App review says they can't log in, but my login is a magic link2 ans.
Sign in with Apple works in my iOS app but gives invalid_client on the web version0 ans.
Hundreds of fake signups overnight, all with random gmail addressessolved

Your answer

Sign in to write an answer