Guide

"Sign in with Google" fails for new people on my live app

Updated 20 October 2026

If Google sign-in works for you but fails for new people on your live site, the standard fix (Google and Supabase docs) is to register your live site's addresses, exactly, in Google Cloud and in your sign-in service. If Google says access is denied, check the app's publishing status.

In our checks of 44 live AI-built apps, almost 1 in 4 (10 of 44) had a sign-up, login or verification-email problem that stopped a new person getting in.

What we add from real checks: it works in the preview and fails on the live address or the custom domain, because only the preview's address was ever registered. Google tells the visitor only the app's owner can fix it, so they leave.

In Google Cloud, add your site's address under Authorized JavaScript origins and your sign-in service's callback URL under Authorized redirect URIs (Google requires an exact match). Then add the live address to your sign-in service's Site URL and Redirect URLs.

Why it happens

The cause is almost always a setting, not code. Google and your sign-in service each keep a list of addresses they trust, and the error Google shows names which list is missing your live site.

Match the error to the fix

redirect_uri_mismatch

Google says the return address in the request does not match an authorized redirect URI for the OAuth client.

In Google Cloud, open your OAuth client and find Authorized redirect URIs.
Add the exact callback URL. With Supabase, copy it from the Google provider page in the Supabase dashboard (it ends in /auth/v1/callback).
Check the details: https, not http; no extra slash at the end; the same host.

origin_mismatch

Your live site's address is not on the client's list of Authorized JavaScript origins.

Add the origin only, without a path: if the app is at https://example.com/app, Supabase says to add https://example.com.
Add every address people use: the builder's published address, your custom domain, and both www and non-www if both open.

access_denied, or "has not completed the Google verification process"

The Google app's publishing status is Testing. Google limits such apps to up to 100 test users listed on the consent screen; apps asking only for name, email and profile are the exception.

Ask only for openid, email and profile unless you truly need more.
Or publish the app: Google counts it as In production after you select Publish app.

No Google error, but you land back on the login page or on localhost

Your sign-in service sent the person to an address it was not told about.

In Supabase, open Authentication, URL Configuration. Set the Site URL to your live address.
Add your live address (and custom domain) to Redirect URLs. Supabase says the redirectTo address in your code should match that list.

Only some company (Google Workspace) accounts fail

Google lists org_internal (the client is limited to one organization's accounts) and admin_policy_enforced (the person's Workspace administrator blocks a requested scope). Set the audience to External for a public app, and ask for basic scopes only.

How to tell it's fixed

Open a private window on the live address (and on the custom domain, if you have one).
Sign in with a Google account that has never used your app and is not a test user.
You land signed in on your live app, not on localhost, the preview or the login page, and the new person appears in your user list.

The main catch

Your own account cannot show it. You are a test user, you consented to Google earlier, or you still have a session, so you skip the screen where new people fail. Google's settings can also take a while to apply after you save them, so test again a little later before changing more.

You can't see it yourself

You're signed in, your customers aren't. You are a test user, you consented to Google earlier, or you have a live session, so you skip the screen where new people fail.

Frequently asked questions

Why does Google sign-in work for me but not for other people?

Usually because the Google app is still in Testing and you are a listed test user, or because you only ever tried the preview address. Register the live address and check the publishing status.

What does redirect_uri_mismatch mean?

The return address your app sent is not on the OAuth client's list of Authorized redirect URIs. Add the exact callback URL, character for character.

Do I need to publish my Google app?

If it asks for more than name, email and profile, yes: in Testing only listed test users can sign in. Publishing moves it to In production.

Why does Google sign-in send people to localhost?

The sign-in service's Site URL or Redirect URLs still name a development address. Set them to your live address in Supabase's URL Configuration.

Can VibeFix fix it for me?

Yes, if you ask. The free check confirms the problem first. Our AI agent can find the cause, fix it in your code and re-check your live app: $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.

Sources (official documentation)

VibeFix is independent. Lovable, Bolt, Replit, Base44, v0, Supabase, Firebase, Stripe and Vercel are trademarks of their owners.

Fixed it? Prove a real stranger gets in

A fix that works from your own account proves nothing about a new customer. Your AI reads your code. VibeFix signs up like a stranger.

Free check. Paste your live app's link: an AI agent signs up to your live app once as a brand-new person ("VibeFix Test") with a real inbox of its own, on a phone and on a computer, and shows how many problems a new user still hits, what each one is, and one screenshot. No account needed. It never changes your app and never emails your users.

Check my live app, free

Want it fixed?

Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.

It starts with a free check that confirms the problem on your live app, no account needed.

Get it fixed — free check first

More guides