---
title: "Google sign-in fails with redirect_uri_mismatch"
description: "The callback address your app sends is not in Google's Authorized redirect URIs list. How to find the right address for Supabase or Firebase and fix it."
url: https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch
---

[Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Sign-in and accounts](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

# Google sign-in fails with redirect_uri_mismatch

VC-24 · Supabase · Firebase · Next.js · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley)

Quick verdict

You can fix this yourself. A copy and paste fix in Google Cloud Console.

- **How serious**: Medium
- **Fix it yourself?**: Yes, you can fix this yourself
- **Typical cost**: $49–$800 one-off check if you want it verified ([prices](https://whocanfixmyapp.com/pricing))
- **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10

**What you see.** Clicking Sign in with Google opens a Google error page that says Error 400 redirect_uri_mismatch.

## Why it happens

Google only returns users to addresses listed in your OAuth client. The error means the address your auth provider sent does not match any entry under **Authorized redirect URIs** in Google Cloud Console. With Supabase, the callback is your project's URL ending in `/auth/v1/callback`, shown on the Google provider page in the Supabase dashboard. With Firebase, the handler lives at your auth domain plus `/__/auth/handler`, and Firebase's own guide says the trailing `/__/auth/handler` is important.

The mismatch usually appears after a move. You added a custom domain, switched from localhost to the live site, or let the agent create a second project. Each change produces a new callback address, and the Google client still holds the old one. A trailing slash, `http` instead of `https`, or a `www` prefix also counts as a different address. Fix the list in Google, not the code.

## Fix it yourself

1. Copy the exact address from the error page. Google prints the redirect_uri it rejected.
2. For Supabase, open **Authentication → Providers → Google** and copy the callback URL shown there. It ends in `/auth/v1/callback`.
3. In Google Cloud Console, open **APIs & Services → Credentials**, select your OAuth client, and paste the callback under **Authorized redirect URIs**. Add your site origin, such as `https://example.com`, under **Authorized JavaScript origins**.
4. For Firebase, add `https://your-domain/__/auth/handler` to the same list, and make sure the domain is in the authorized domains list under **Authentication** settings in the Firebase console.
5. Remove `http://localhost` entries before launch and save. Wait a few minutes, then test in a private window.

## When to get an engineer

Stop when the list matches and the error persists, or when the app also uses a custom auth domain. Tell the engineer the exact rejected address from the error page and which provider you use. A check is $49–$800, or a single fix €99–$990, and it usually takes a day. Ask them to confirm the Supabase Site URL and Redirect URLs at the same time, since the two lists fail together (see [sign-in fails on my custom domain](https://whocanfixmyapp.com/problems/auth-works-in-preview-fails-on-custom-domain)).

## Top-rated companies for Supabase apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score).

- 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490
- 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299
- 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399

[All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers)

## Check these

AUTH-01 · High

Sign-up confirmation and password reset work end to end

Use a real inbox. Check that the link arrives, points to your live domain, and works once.

AUTH-02 · High

Signing out really ends the session

Sign out, press Back, and refresh. You should not see private pages or data.

OPS-04 · Medium

Secrets live in the host's environment settings

Keys belong in environment variables on the server, not in the repository or in front-end code.

## Questions

### Do I need a separate Google client for the live site?

No. One client can hold several redirect URIs and origins. Add the live addresses next to the preview ones, and remove localhost before launch.

### Why does the Google consent screen show a supabase.co address?

Without a custom auth domain, Google shows your project's supabase.co hostname. Supabase recommends a custom domain such as auth.example.com if you want your own name there.

Sources: [Supabase: Login with Google](https://supabase.com/docs/guides/auth/social-login/auth-google); [Firebase: Best practices for signInWithRedirect](https://firebase.google.com/docs/auth/web/redirect-best-practices); [Supabase: Redirect URLs](https://supabase.com/docs/guides/auth/redirect-urls).

**Supabase guide**

What Supabase builds, where it breaks and how to check it: [Supabase RLS audit: how to check an AI-built app's database rules](https://whocanfixmyapp.com/guides/supabase).

**Same category**

- [Users can't log in on the live site](https://whocanfixmyapp.com/problems/users-cant-log-in-on-the-live-site)
- [Confirmation and password-reset emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive)
- [Users get logged out when they refresh the page](https://whocanfixmyapp.com/problems/users-get-logged-out-on-refresh)
- [Admin pages open to anyone with the link](https://whocanfixmyapp.com/problems/admin-pages-open-to-anyone-with-the-link)
- [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data)
- [Supabase says "new row violates row-level security policy"](https://whocanfixmyapp.com/problems/supabase-rls-blocking-insert)

[All sign-in and accounts problems](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

**Run every check**

The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.