Supabase Google OAuth setup (and what to check when it isn't working)

How the redirects fit together

There are two separate hops, and most setup mistakes come from mixing them up:

1. Google → Supabase. Google sends the user back to Supabase Auth at https://<project-ref>.supabase.co/auth/v1/callback. This is the URL Google checks against the client's Authorized redirect URIs. If it doesn't match, Google shows redirect_uri_mismatch.
2. Supabase → your app. Supabase then sends the user to the redirectTo you passed, as long as it matches the Redirect URLs allow list. With no redirectTo, Supabase uses the Site URL.

So Google only ever needs to know about Supabase's callback. Preview URLs, localhost:3000 and your production domain are all handled on the Supabase side.

Step 1: Configure the Google Auth Platform

In the Google Auth Platform console (as of Oct 2026), pick or create a Google Cloud project, then:

• Branding: set the app name, support email and links to your privacy policy and terms. Google only shows your app name on the consent screen after brand verification (see why Google shows the wrong app name).
• Audience: choose External for public apps. While the app is in Testing, Google limits access to listed test users, with an exception for apps that request only basic sign-in scopes (name, email, profile).
• Data Access (Scopes): add openid manually. .../auth/userinfo.email and .../auth/userinfo.profile are added by default. Adding sensitive or restricted scopes can trigger a long Google review.

Step 2: Create the OAuth client ID

In Clients → Create client (as of Oct 2026):

1. Application type: Web application.
2. Authorized JavaScript origins: your app's origin with no path, for example https://example.com (not https://example.com/app). Add http://localhost:3000 (or your dev port) while developing, and remove it before going to production.
3. Authorized redirect URIs: copy the callback URL shown on the Google provider page in the Supabase dashboard. It has this shape:

https://<project-ref>.supabase.co/auth/v1/callback

For the local Supabase CLI stack, also add:

http://127.0.0.1:54321/auth/v1/callback

4. Click Create and copy the Client ID and Client Secret.

Google's redirect URIs must use HTTPS (localhost is exempt) and cannot contain wildcards. Google also notes that changes to these settings can take 5 minutes to a few hours to take effect.

Step 3: Turn on the Google provider in Supabase

Hosted project (dashboard): open the Google provider page under Authentication in the Supabase dashboard (as of Oct 2026), enable it, paste the Client ID and Client Secret, and save.

Local development (Supabase CLI): put the secret in .env and reference it from supabase/config.toml:

[auth.external.google]
enabled = true
client_id = "<your-web-client-id>.apps.googleusercontent.com"
secret = "env(SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_SECRET)"
skip_nonce_check = false

Restart the local stack (supabase stop, then supabase start) so the change is picked up. If you have several client IDs (web, iOS, Android), list them comma-separated with the web client ID first.

Step 4: Set the Site URL and Redirect URLs

On the URL Configuration page in the Supabase dashboard (as of Oct 2026):

• Site URL: change the default http://localhost:3000 to your production URL, for example https://example.com.
• Redirect URLs: add every URL you will pass as redirectTo, for example:

https://example.com/auth/callback
http://localhost:3000/**

Wildcard rules, preview-deployment patterns and config.toml equivalents are covered in Supabase redirect URLs explained.

Step 5: Add the sign-in code (supabase-js v2)

Browser-only app (implicit flow)

If you use createClient from @supabase/supabase-js without server-side rendering, one call is enough. Supabase redirects back to your app with the session.

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  'https://<project-ref>.supabase.co',
  '<your-publishable-key>'
)

export async function signInWithGoogle() {
  const { error } = await supabase.auth.signInWithOAuth({
    provider: 'google',
    options: {
      // Must match an entry in Redirect URLs
      redirectTo: `${window.location.origin}/`,
    },
  })
  if (error) console.error(error.message)
}

Server-side rendering (PKCE flow, Next.js App Router)

With @supabase/ssr, Supabase returns a code to a callback route that you exchange for a session. Start sign-in from the browser client:

'use client'
import { createClient } from '@/lib/supabase/client' // createBrowserClient helper

export function GoogleButton() {
  const onClick = async () => {
    const supabase = createClient()
    await supabase.auth.signInWithOAuth({
      provider: 'google',
      options: { redirectTo: `${window.location.origin}/auth/callback` },
    })
  }
  return <button onClick={onClick}>Continue with Google</button>
}

Then handle the code in app/auth/callback/route.ts:

import { NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server' // createServerClient helper

export async function GET(request: Request) {
  const { searchParams, origin } = new URL(request.url)
  const code = searchParams.get('code')
  let next = searchParams.get('next') ?? '/'
  if (!next.startsWith('/')) next = '/'

  if (code) {
    const supabase = await createClient()
    const { error } = await supabase.auth.exchangeCodeForSession(code)
    if (!error) {
      const forwardedHost = request.headers.get('x-forwarded-host')
      const isLocal = process.env.NODE_ENV === 'development'
      if (isLocal) return NextResponse.redirect(`${origin}${next}`)
      if (forwardedHost) return NextResponse.redirect(`https://${forwardedHost}${next}`)
      return NextResponse.redirect(`${origin}${next}`)
    }
  }
  return NextResponse.redirect(`${origin}/auth/auth-code-error`)
}

Remember to add https://example.com/auth/callback (and your local equivalent) to Redirect URLs.

How to confirm it worked

1. Click your Google button and look at the address bar on the Google screen. The redirect_uri query parameter should be your Supabase callback, https://<project-ref>.supabase.co/auth/v1/callback.
2. After choosing an account, you should land on your redirectTo URL (or /auth/callback, then your app), not on localhost.
3. Call supabase.auth.getUser() and check that it returns the Google account's email. The user also appears under Authentication → Users in the dashboard (as of Oct 2026).

Supabase Google OAuth not working: checklist