Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
…
Sign in
Question

Error 400: redirect_uri_mismatch when I click Sign in with Google

Solved · 1301 viewsasked by jakeypoo
cursorsupabaseauthnextjs

Set up Google login with Supabase following what Cursor told me. The Google popup shows:

Access blocked: This app's request is invalid
Error 400: redirect_uri_mismatch

In Google Cloud Console I put http://localhost:3000/auth/callback as the redirect URI because that is the route Cursor made. Also tried the production one. Same error.

What I’ve tried

Added every URL I could think of to 'Authorized JavaScript origins'. Waited an hour in case Google needs time. Created a second OAuth client, same thing.

Comment
Which list did you add it to, 'Authorized JavaScript origins' or 'Authorized redirect URIs'? They're easy to mix up. wes_codes
origins... and then redirect URIs with my own callback jakeypoo

3 answers

Marked as helpful by the asker
mira_dev

The flow has two hops: Google → Supabase → your app. Google only ever talks to Supabase, so Google needs Supabase's callback, not yours.

In Google Cloud Console, your OAuth client → Authorized redirect URIs (not JavaScript origins):

https://<your-project-ref>.supabase.co/auth/v1/callback

You find the exact URL in Supabase under Authentication → Providers → Google, there's a copy button.

Your /auth/callback route belongs in Supabase's Redirect URLs allow-list instead. Different list, different dashboard.

Comment
that was it. two dashboards two lists, makes sense now. thanks jakeypoo
The 'Google only talks to Supabase' sentence finally made this click for me. sam_builds
wes_codes

The URI must match character for character: https, no trailing slash, exact project ref. If you pasted it by hand, compare it with the one in the Supabase provider page.

Comment
jonas_k

Note for later: if you ever set up a custom domain for Supabase Auth (e.g. auth.yourapp.com), the callback URL changes to that domain. Update the Google client at the same time or login breaks the moment you switch.

Comment

Related

After logout my header still shows the old user until I hard refreshsolved
Logged in on myapp.com but logged out on app.myapp.com2 ans.
Users get logged out randomly, logs say Invalid Refresh Token: Already Usedsolved
Page knows I'm logged in, but my API route says Auth session missingsolved
RLS blocks my own inserts from the app but the dashboard workssolved

Your answer

Sign in to write an answer