Google sign-in fails on your custom domain: redirect_uri_mismatch

Short answer: Google only sends people back to a redirect URI you listed for your OAuth client. Add your Supabase callback URL under Authorized redirect URIs in the Google Auth Platform console, and set your custom domain as the Site URL in Supabase URL Configuration.

Applies to: apps made with AI app builders such as Lovable, Bolt, Base44, Replit and v0 whose Google sign-in runs on a Supabase project you manage. The steps below use the Google Auth Platform console and the Supabase Dashboard.

Why it happens

When someone taps Sign in with Google, Google checks the redirect_uri in the request against the Authorized redirect URIs on your OAuth client. Google's docs state the value must exactly match one of them, and that the http or https scheme, letter case and trailing slash must match too. If it does not match, you get redirect_uri_mismatch.

With Supabase as your backend, the redirect URI Google sees is your Supabase project's callback URL, not your app's page. Supabase tells you to add your Supabase project's callback URL under Authorized redirect URIs, and to get it from the Google provider page on the Dashboard. For local development the docs give http://127.0.0.1:54321/auth/v1/callback.

Separately, Supabase has its own allow list. The redirectTo value your app sends should match the Redirect URLs list, and the Site URL in URL Configuration is the default redirect when no redirectTo is set. Supabase calls this setting critical for email confirmations and password resets, and says to change it from http://localhost:3000 to your production URL.

So there are two addresses, and each goes in a different place:

• The Supabase callback URL (from the Google provider page on the Supabase Dashboard) goes into Authorized redirect URIs in the Google Auth Platform console.
• Your custom domain goes into the Site URL and Redirect URLs in Supabase URL Configuration, and your app's URL goes into Authorized JavaScript origins in Google.

How to fix it

1. Open the Google Auth Platform console, go to the Clients section, and open the Web application OAuth client your app uses.
2. Under Authorized redirect URIs, add your Supabase project's callback URL. Copy it from the Google provider page on the Supabase Dashboard. Keep the scheme, letter case and trailing slash exactly as shown.
3. Under Authorized JavaScript origins, add your application's URL. Supabase's example: if your app is hosted on https://example.com/app, add https://example.com. The docs say these should also be configured as the Site URL or redirect configuration in your project.
4. Remove http://localhost:<port> from the origins when your app goes into production. Supabase says to remember to remove this.
5. In Supabase, open the URL Configuration page. Set the Site URL to your production URL, for example https://example.com.
6. On the same page, add your custom domain to the Redirect URLs list, so the redirectTo your app sends is allowed.
7. If your app uses a PKCE flow, pass a redirectTo that points to your callback route, for example https://example.com/auth/callback, and make sure that URL is on the Redirect URLs list. Supabase's example call is supabase.auth.signInWithOAuth({ provider, options: { redirectTo: 'http://example.com/auth/callback' } }).
8. If you use redirectTo, check your email templates. Supabase says you may need to replace {{ .SiteURL }} with {{ .RedirectTo }} in them.
9. Save the OAuth client in Google, then try signing in again on your custom domain.

How to check it worked on your live app

1. Open a private browser window so no old session is reused.
2. Use a fresh email address you have not signed in with before.
3. Go to your custom domain, not the preview and not a lovable.app address.
4. Tap Sign in with Google and complete the consent screen.
5. You should land back on your custom domain, signed in, with no redirect_uri_mismatch page.

Prompt to paste into your AI builder

Paste this into your AI builder: "Google sign-in fails on my custom domain with redirect_uri_mismatch. Show me the change first, then make it. In the Supabase sign-in call, set redirectTo to my production callback route on my custom domain, for example https://example.com/auth/callback, instead of localhost or the preview URL. List every place in my code that uses a localhost or preview URL for sign-in. Tell me which Site URL and Redirect URLs I need to enter in Supabase URL Configuration. I will copy the Supabase callback URL myself from the Google provider page on the Supabase Dashboard and add it under Authorized redirect URIs in the Google Auth Platform console. If my email templates use {{ .SiteURL }}, tell me whether to change them to {{ .RedirectTo }}."

FAQ

Where do I find my Supabase callback URL? On the Google provider page on the Supabase Dashboard. Supabase's docs point there for the callback URL you add under Authorized redirect URIs.

What goes in Authorized JavaScript origins? Your application's URL. Supabase's example: for an app hosted on https://example.com/app, add https://example.com.

What is the Site URL for? It is the default redirect URL when no redirectTo is set in your code. Supabase says to change it from http://localhost:3000 to your production URL.

Does the trailing slash matter? Yes. Google's docs state the scheme, letter case and trailing slash must match the authorized redirect URI.

Can I keep localhost for development? Yes. Supabase says to add http://localhost:<port> while developing locally, and to remove it when your application goes into production.

Related guides

• Sign-up or login broken after publishing (Supabase redirect URLs) walks through the Supabase URL Configuration settings after you publish.
• "Sign in with Google" fails for new people on my live app: why, and the fix is for when only new visitors hit the problem.

Sources

• Sign in with Google | Supabase Docs
• Redirect URLs | Supabase Docs
• Using OAuth 2.0 for Web Server Applications | Google for Developers

VibeFix's check can show this on your live app: its AI agent signs up to your app like a new person, uses it on a phone and a computer, and shows what breaks. VibeFix checks; it does not fix your app.

Last checked: 18 October 2026, against the sources listed above.

VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.