Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

Google login says 'continue to xkqzjwp.supabase.co', customers think it's a scam

Solved · 4104 views · asked by bakery_bo · edited
lovablesupabaseauthsecurity

My bakery order app has 'Continue with Google'. Works fine, but the Google screen says

Choose an account
to continue to xkqzjwp.supabase.co

Two customers emailed me asking if my site was hacked, and one said she stopped because of it. How do I make it show my bakery name?

What I’ve tried

Filled in the app name in Google Cloud Console under the consent screen. Still shows the weird address. Asked Lovable, it said it's a Google limitation.

Comment
Which Google Cloud screen did you fill the name in, and does the consent screen show 'Verification status'? mira_dev · edited
Same here, my customers asked if it was phishing. Following. sam_builds · edited
Adding this to my list of things to check before going live. gabriel_ss · edited

3 answers

Marked as helpful by the asker
mira_dev · edited

Google shows the domain the login redirects to, and with Supabase that's your project's supabase.co address (Google → Supabase → your app). Two ways to change it:

  1. Brand verification in Google Cloud Console → OAuth consent screen / Branding: app name, logo, your homepage, privacy policy and terms links, and your own domain verified in Search Console. After Google approves the branding, the account chooser shows your app name instead of the raw domain. Takes a few days, costs nothing.
  2. Custom domain for Supabase Auth (e.g. auth.yourbakery.com), a paid add-on on Supabase. Then even the domain shown is yours. You'll need to add the new callback URL to Google too.

For a small shop, do 1 first. Most people only care that they see a name they recognize.

Comment
I didn't have a privacy policy page at all, so that's probably why it never showed the name. Making one now. bakery_bo · edited
Update: branding approved after 3 days, it now says 'to continue to Bo's Bakery'. Thank you! bakery_bo · edited
Bookmarking this. My yoga app has the same weird address. renata_builds · edited
rafa_dev · edited

If you go the custom domain route later: do it before you have many users, and test the whole login again. The callback URL changes, so Google (and any other provider) must get the new one in their redirect URI list, or login breaks the moment you switch.

Comment
Noted, branding first then. bakery_bo · edited
ingrid_h · edited

While you're in that console: check the publishing status. If it's still Testing, only the test users you listed can log in and everyone else gets an 'access blocked' page. Press 'Publish app'. For basic profile/email scopes there's no extra review beyond the branding check.

Comment
It was on Published already, but good to know. bakery_bo · edited

Related

Hundreds of fake signups overnight, all with random gmail addressessolved
infinite recursion detected in policy for relation "profiles"solved
Users can give themselves unlimited credits by editing their own profile rowsolved
My admin page is just hidden from the menu, is that protection?solved
RLS for 'members of a team can see the team's projects', how do I write that?solved

Your answer

Sign in to write an answer