VVibeFix

Guide · Base44

Google sign-in "origin_mismatch" on Base44 (and other apps): what it means and how to fix it

Updated

A new visitor taps Sign in with Google and Google shows an error page with origin_mismatch instead of your app. Google documents the error in its OAuth 2.0 errors list. It appears when the address sign-in starts from is not on the Google client's Authorized JavaScript origins, for example after switching to custom Google OAuth on Base44 or moving to a new domain.

Can a stranger actually sign up and get your email? Get it fixed: a free check first confirms the problem on your live app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

Want it fixed? Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front.

What the error means

Google says: "The scheme, domain, and/or port of the JavaScript originating the authorization request may not match an authorized JavaScript origin URI registered for the OAuth client ID." In plain words, the address the sign-in started from is not on the client's list of Authorized JavaScript origins. Google's help page says the same: a request from an unregistered JavaScript origin returns origin_mismatch.

An origin is only the scheme, the domain and the port, such as https://yourapp.com. Google's rules say an origin cannot contain a path, a query, a fragment or a wildcard, and must use https unless it is localhost.

The causes, and how to fix each one

Check the address in the browser bar on the page where sign-in starts. That is the origin Google compares.

1. The domain people use is not on the list

The address was never added, or only one form of it was. An origin includes the domain, so the address with www and the one without are two different origins.

How to fix it

  1. In Google Cloud, open Google Auth Platform, then Clients, and open your Web application client.
  2. Under Authorized JavaScript origins, add the exact address from the browser bar, for example https://yourapp.com.
  3. If people reach the app both with and without www, add both.
  4. Save, wait and retry. Google says changes "may take 5 minutes to a few hours" to take effect.

Source: Google: OAuth 2.0 for client-side web applications, Google Cloud Help: Manage OAuth clients

2. The origin was entered in a form Google does not accept

An entry with a path (https://yourapp.com/login), a wildcard, or plain http on a live domain does not match.

How to fix it

  1. Edit each entry so it is only https:// plus the domain, with a port only if your app uses one.
  2. Remove wildcard entries and list each real domain.
  3. Keep http only for localhost addresses.

Source: Google: OAuth 2.0 for client-side web applications, Google Cloud Help: Manage OAuth clients

3. Base44: custom Google OAuth is set up incompletely

Base44's custom Google OAuth needs a Builder plan or higher, a payment method on the Google Cloud project, and a custom domain connected to the app first. On the Google client, Base44 says to enter your app domain as the Authorized JavaScript origin and https://app.base44.com/api/apps/auth/callback as the Authorized redirect URI.

How to fix it

  1. Connect your custom domain to the Base44 app and confirm it loads.
  2. In Google Cloud, verify the domain in Google Search Console and add it as an authorized domain under Branding.
  3. Under Clients, create the client and set Authorized JavaScript origins to your app domain and Authorized redirect URIs to https://app.base44.com/api/apps/auth/callback.
  4. Under Data Access, select the openid and https://www.googleapis.com/auth/userinfo.email scopes.
  5. Add public pages for your privacy policy and terms of service; Base44 says they are required for Google approval.
  6. In Base44, open Dashboard, then Settings, then Authentication, turn on Google authentication, select "Use a custom OAuth from Google Console", enter the Client ID and Client Secret, and click Update.
  7. Allow for Google's review: Base44 says approval "can take up to 5 days".

Source: Base44: Managing login and registration

4. Supabase apps: the app address is not on both lists

Supabase says the Authorized JavaScript origins on the Google client "should also be configured as the Site URL or redirect configuration in your project", and to add only the origin, not the full path.

How to fix it

  1. Add your app's origin (for example https://yourapp.com) to Authorized JavaScript origins on the Google client.
  2. In Supabase, open the URL Configuration page and make sure the same address is the Site URL or on the Redirect URLs list.
  3. Remove http://localhost from the Google client's origins when the app goes live, as Supabase advises.

Source: Supabase: Login with Google

5. The change is too recent

Google says changes to these settings may take 5 minutes to a few hours to take effect, so a correct fix can still fail for a while.

How to fix it

  1. After saving, allow 5 minutes to a few hours before deciding the fix did not work.
  2. Then test signed out of your app, for example in a private window.

Source: Google Cloud Help: Manage OAuth clients

Your AI reads your code. VibeFix signs up like a stranger. Get it fixed: a free check first confirms the problem on your live app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

Want it fixed? Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front.

Why you cannot see it yourself

You're signed in, your customers aren't. You are probably already signed in, or you tested on the address that is on the list. A new person arriving on another address, such as www or the new custom domain, is the one Google stops.

Frequently asked questions

What is the difference between origin_mismatch and redirect_uri_mismatch?

origin_mismatch is about where sign-in starts (Authorized JavaScript origins). redirect_uri_mismatch is about where Google sends the person back (Authorized redirect URIs). Both are fixed on the same Google client. See the "redirect_uri_mismatch" guide.

Only the www version (or only the version without www) fails. Why?

An origin includes the domain, so they are two different origins. Add both to Authorized JavaScript origins, or send everyone to one of them.

Can I use a wildcard to cover all my preview addresses?

No. Google says JavaScript origins cannot contain wildcard characters. Each address has to be listed.

Can VibeFix fix it for me?

Yes, if you ask. The free check confirms the problem first. Our AI agent can find the cause, fix it in your code and re-check your live app: $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.

Related guides

Sources (official documentation)

Fixed it? Prove a real stranger gets in

After the fix, the proof is a person who has never signed in starting Google sign-in on the exact address your customers use. Your own account cannot show that, because it is not new. Your AI reads your code. VibeFix signs up like a stranger.

Free check. An AI agent signs up to your live app as a brand-new person, with a real inbox of its own, on a phone and on a computer. You get the problem count, what each problem is, and one screenshot. It never changes your app and never emails your users. Test my app, free

VibeFix is independent. Google, Base44, Supabase and Lovable are trademarks of their owners.

Want it fixed?

Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.

It starts with a free check that confirms the problem on your live app, no account needed.

Get it fixed — free check first

More guides