Google sign-in "Error 400: redirect_uri_mismatch" or login goes to localhost

Short answerGoogle only redirects to callback URLs you registered, character for character. If you use Supabase Auth, Google redirects to Supabase first, and Supabase then sends the user to your Site URL or an allowed redirect URL. Both lists have to include your live domain.

Error 400: redirect_uri_mismatch

In Google Cloud Console, open your OAuth client and add the exact callback URL to Authorized redirect URIs. For Supabase Auth, that is your project's callback, in the form https://<project-ref>.supabase.co/auth/v1/callback. Protocol, subdomain and path all have to match.

Sign-in works, then lands on localhost

Supabase sends users to the Site URL unless the app asks for another allowed URL. If the Site URL is still http://localhost:3000, that is where people end up. In Supabase, open Authentication, then URL Configuration, set the Site URL to your live domain, and add your other domains to Redirect URLs.

// Ask Supabase to return to the page the user came from
await supabase.auth.signInWithOAuth({
  provider: "google",
  options: { redirectTo: `${window.location.origin}/auth/callback` },
});

Not sure which of these it is? We'll tell you in 24 hours, free.

Get a free health check

Preview deployments break login

Preview URLs change with every deploy. Supabase Redirect URLs accept wildcard patterns, so you can allow your preview domain pattern without listing each one. Keep production URLs exact.

The Google consent screen says the app isn't verified

While your OAuth consent screen is in testing, only listed test users can sign in. Publish the app in Google Cloud Console when you're ready for everyone, and complete verification if Google asks for it.

Questions people ask

Which redirect URI do I give Google when I use Supabase Auth?

Your Supabase project's callback URL, https://<project-ref>.supabase.co/auth/v1/callback. Your own domain goes in Supabase's Site URL and Redirect URLs, not in Google.

Why does my app redirect to localhost after Google login?

The Supabase Site URL is still set to localhost, or the redirectTo URL your app requests isn't in the allow list, so Supabase falls back to the Site URL. Update both in Authentication settings.

Sources

Google sign-in broken after launch? Fix the redirect settings.