VVibeFix

Guide · Base44

Base44 Google login origin_mismatch: set the app domain

Short answer: Google shows origin_mismatch when the domain your Base44 app sends the sign-in request from is not listed as an Authorized JavaScript origin for your OAuth client. Add your app domain in Google Cloud Console, then try again.

Why it happens

When you set up custom Google OAuth in Base44, you connect your own Google Cloud client ID and secret. Google checks the address the sign-in request comes from against the Authorized JavaScript origins you registered for that client.

Google's own help says it plainly: if you send a request to a Google OAuth 2.0 endpoint from an unregistered JavaScript origin, you receive an origin_mismatch error. The error means the scheme, domain and/or port of the JavaScript that made the request does not match the authorized JavaScript origins registered for the OAuth client.

So the usual cause is a domain that was never added, or was added in a form Google does not accept. Google's rules for origins are strict: they must use HTTPS, not plain HTTP (localhost is exempt), hosts cannot be raw IP addresses, and an origin cannot contain a path, query or fragment component. If you use a port other than 80, you must specify it.

How to fix it

  1. Open your app editor, click Dashboard, click Domains, and note the exact address people use to reach your app. Base44 gives every app a built-in URL such as myapp.base44.app, and you can connect your own custom domain.
  2. Go to the Google Cloud Console and open the Clients page of the Google Auth Platform for the project that holds your OAuth client.
  3. Open the OAuth client you connected to Base44.
  4. In Authorized JavaScript origins, add your app domain exactly as people reach it, for example https://myapp.base44.app or https://mybusiness.com. Use HTTPS, and do not add a path after the domain.
  5. If you use a port other than 80, include it, for example https://example.com:8080.
  6. Check that Authorized redirect URIs contains https://app.base44.com/api/apps/auth/callback, which is the value Base44's custom Google OAuth setup asks for.
  7. Save the client. Google notes that changes to these settings can take 5 minutes to a few hours to take effect.
  8. Go back to Base44: click Dashboard, click Settings, click Authentication, and confirm the Google authentication toggle is on and Use a custom OAuth from Google Console is selected with your client details entered.

If you are setting up custom Google OAuth for the first time, Base44 also asks you to connect a custom domain to your app, verify your domain, and add your domain as an authorized domain in the OAuth app's branding. Custom Google OAuth requires a Builder plan or higher, and a payment method connected to your project in Google Cloud Console.

How to check it worked on your live app

  1. Publish your app, then open the live URL in a private browser window.
  2. Use a fresh email address you have not signed up with before.
  3. Click the Google sign-in button on your login or register page.
  4. Confirm the Google window opens without origin_mismatch and shows your app's domain rather than base44.com.
  5. Finish signing in and confirm you land back in your app, signed in.

Prompt to paste into your AI builder

Paste this into your AI builder: "My Base44 app uses custom Google OAuth and Google shows origin_mismatch when someone clicks the Google sign-in button. Show me first, before changing anything, which domain my app's Google sign-in request is sent from, and confirm it matches the Authorized JavaScript origins on my Google Cloud OAuth client. Then tell me the exact origin value I should add in Google Cloud Console under Authorized JavaScript origins, using HTTPS with no path, and confirm the Authorized redirect URI is https://app.base44.com/api/apps/auth/callback. Do not change my login pages until you have shown me this."

FAQ

What does origin_mismatch mean? Google's help says the scheme, domain and/or port of the JavaScript that made the authorization request does not match the authorized JavaScript origins registered for the OAuth client. Check the Authorized JavaScript origins on the Clients page of Google Cloud Console.

Is this the same as redirect_uri_mismatch? No. redirect_uri_mismatch means the redirect_uri sent in the request does not match an authorized redirect URI for the client. origin_mismatch is about the JavaScript origin. Both are checked on the same Clients page.

Can I use my custom domain in the origin? Yes, as long as it is the address people actually use to reach your app. Base44 lets you connect a custom domain, and custom Google OAuth is set up so people see your app's domain instead of base44.com. Add that domain as an authorized JavaScript origin.

Why does the Google window still say base44.com? Base44's docs say that if Google still shows base44.com as the app name or badge, your custom Google project has not been fully approved yet. Once Google approves it, your app's own name or branding appears.

How long until my change takes effect? Google notes it may take 5 minutes to a few hours for changes to these settings to take effect. Base44 also notes that after finishing custom Google OAuth setup you wait for Google to verify and approve your app, which can take up to 5 days.

Related guides

Sources

VibeFix's check can show this on your live app: its AI agent signs up to your app like a new person, uses it on a phone and a computer, and shows what breaks. VibeFix checks; it does not fix your app.

Last checked: 18 October 2026, against the sources listed above.

VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.

Still stuck?

Paste your app’s link for a free sign-up check, no account needed. An AI agent signs up to your live app as a brand-new person, on a phone and a computer, and tells you whether a new person can finish.

Test my app — free

More guides