By You can fix this yourself. A copy and paste fix in Google Cloud Console.
What you see. Clicking Sign in with Google opens a Google error page that says Error 400 redirect_uri_mismatch.
Why it happens
Google only returns users to addresses listed in your OAuth client. The error means the address your auth provider sent does not match any entry under Authorized redirect URIs in Google Cloud Console. With Supabase, the callback is your project's URL ending in /auth/v1/callback, shown on the Google provider page in the Supabase dashboard. With Firebase, the handler lives at your auth domain plus /__/auth/handler, and Firebase's own guide says the trailing /__/auth/handler is important.
The mismatch usually appears after a move. You added a custom domain, switched from localhost to the live site, or let the agent create a second project. Each change produces a new callback address, and the Google client still holds the old one. A trailing slash, http instead of https, or a www prefix also counts as a different address. Fix the list in Google, not the code.
Fix it yourself
- Copy the exact address from the error page. Google prints the redirect_uri it rejected.
- For Supabase, open Authentication → Providers → Google and copy the callback URL shown there. It ends in
/auth/v1/callback. - In Google Cloud Console, open APIs & Services → Credentials, select your OAuth client, and paste the callback under Authorized redirect URIs. Add your site origin, such as
https://example.com, under Authorized JavaScript origins. - For Firebase, add
https://your-domain/__/auth/handlerto the same list, and make sure the domain is in the authorized domains list under Authentication settings in the Firebase console. - Remove
http://localhostentries before launch and save. Wait a few minutes, then test in a private window.
When to get an engineer
Stop when the list matches and the error persists, or when the app also uses a custom auth domain. Tell the engineer the exact rejected address from the error page and which provider you use. A check is $49–$800, or a single fix €99–$990, and it usually takes a day. Ask them to confirm the Supabase Site URL and Redirect URLs at the same time, since the two lists fail together (see sign-in fails on my custom domain).
Top-rated companies for Supabase apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 2Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Check these
Sign-up confirmation and password reset work end to end
Use a real inbox. Check that the link arrives, points to your live domain, and works once.
Signing out really ends the session
Sign out, press Back, and refresh. You should not see private pages or data.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
Questions
Do I need a separate Google client for the live site?
No. One client can hold several redirect URIs and origins. Add the live addresses next to the preview ones, and remove localhost before launch.
Why does the Google consent screen show a supabase.co address?
Without a custom auth domain, Google shows your project's supabase.co hostname. Supabase recommends a custom domain such as auth.example.com if you want your own name there.
Sources: Supabase: Login with Google; Firebase: Best practices for signInWithRedirect; Supabase: Redirect URLs.