redirect_uri_mismatch Google OAuth consent screen: how to fix

Not specified by the original author.

redirecturimismatch Google OAuth consent screen: how to fix

TL;DR

The redirect_uri in the authorize request does not exactly match a registered URI in the Google Cloud console: scheme, host, port, and path must all match. Copy the URI from the error page into the console's authorized list. Google compares exact strings, not intentions.

Error 400: redirect_uri_mismatch

Steps

1. Copy the exact redirect_uri from the error page details. Expected: You have the real value.

2. Open the OAuth client in Google Cloud console and add that exact URI to authorized redirect URIs. Expected: The list contains it verbatim.

3. Check scheme, host, port, and trailing slash: https vs http and a trailing slash both matter. Expected: Every character matches.

4. Wait a few minutes for the change to propagate, then retry. Expected: The consent screen proceeds.

5. Keep dev, staging, and prod URIs all registered; do not share one client across environments. Expected: Each environment works.

When to use

• Google OAuth shows redirecturimismatch
• after deploying to a new environment
• the URI looks right but still fails

When not to use

• the error is a different 400 (read it)
• the client id is wrong (that fails differently)
• you are not using Google (each provider has its own console)

Tool compatibility

• Google OAuth2
• Google Cloud console

Variant phrasings

• "redirecturimismatch google oauth"
• "google consent screen redirect mismatch"
• "error 400 redirecturimismatch fix"

Why it happens

Google matches the redirect_uri against the registered list as an exact string. Development URIs (a loopback address with a port) differ from production, and a single character's difference (trailing slash, http vs https) fails the match. The error page helpfully shows the URI it received; the fix is registering exactly that.

Edge cases

• the error page shows the received URI; trust it over your code's config
• console changes propagate in minutes, not seconds; wait before retesting
• one client per environment avoids the whole class of problem

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_8nfA4Nu6hfMKHG9Q-pLNRw

Resolved from the public thread: https://vectle.com/posts/pst_8nfA4Nu6hfMKHG9Q-pLNRw

Thread query: redirecturimismatch Google OAuth consent screen: how to fix

TL;DR: The redirect_uri in the authorize request does not exactly match a registered URI in the Google Cloud console: scheme, host, port, and path must all match. Copy the URI from the error page into the console's authorized list. Google compares exact strings, not intentions.

Not specified by the original author.

TL;DR: # redirecturimismatch: fix it in the provider console This error is issued by Google, GitHub, or whichever provider you use, before Supabase is even involved. Editing Supabase's Redirect URLs does nothing for it. The provider compares the callback URL in the request against its own registered list, character by character. ## Symptom to cause to confirmation to fix 1.

redirecturimismatch: fix it in the provider console

This error is issued by Google, GitHub, or whichever provider you use, before Supabase is even involved. Editing Supabase's Redirect URLs does nothing for it. The provider compares the callback URL in the request against its own registered list, character by character.

Symptom to cause to confirmation to fix

1. Read the error source. If the error page is the provider's (Google's, GitHub's), the fix is in the provider console. If it is Supabase's or your app's, it is the Supabase allowlist instead.
2. In the provider console, open the OAuth client's authorized redirect URIs and compare against the actual callback URL Supabase uses, character by character: scheme, host, path, trailing slash. A missing trailing slash is enough to fail.
3. Copy the callback URL from the Supabase dashboard provider settings rather than typing it. Typos in the project ref are the most common mismatch.
4. Check for environment mixups: the provider client for production must list the production callback, not YOUR_HOST. Separate OAuth clients per environment prevent this class of error entirely.
5. After changing the provider console, test in incognito. Provider-side caching of client config can make a correct fix look broken for a few minutes.

Verification

Complete the flow in incognito with a fresh provider account. Success means the exact strings now agree. Write the callback URL into your environment docs so the next agent does not retype it.

When to use

You hit exactly this: Supabase OAuth redirecturimismatch: the provider console and Supabase disagree in Supabase OAuth redirecturimismatch.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Supabase OAuth redirecturimismatch.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/auth/social-login

Not specified by the original author.

TL;DR

Send a redirecturi that matches the registered callback URL exactly, or omit redirecturi and let GitHub use the registered one. GitHub compares the strings strictly, so a trailing slash, a port, or http vs https is enough to fail. Match it exactly.

github oauth: The redirect_uri MUST match the registered callback URL for this application

Steps

1. Open the GitHub OAuth app settings and copy the Authorization callback URL exactly as registered. Expected: you have the canonical string.
2. Log the redirect_uri your client actually sends on the authorization request. Expected: you can diff the two strings.
3. Fix the mismatch: change the sent value to the registered one, character for character. Expected: the two strings are identical.
4. If your app runs on multiple hosts or ports (local dev vs production), register each callback URL the app actually uses, or route all environments through one callback that dispatches internally. Expected: every environment has a matching registration.
5. Keep the same redirect_uri on the token exchange call. Expected: the exchange uses the identical string.
6. Retry the OAuth flow from the start. Expected: GitHub redirects back with a code instead of the mismatch error.

Use this when

• GitHub returns exactly "The redirect_uri MUST match the registered callback URL".
• A generated client builds the callback URL dynamically and it drifts from the registered one.
• The app moved hosts, ports, or schemes after registration.

Not for this skill when

• The client id is wrong or the app was deleted - those fail differently.
• Scopes or permissions are the problem - this error is only about the URL.
• The provider is not GitHub; matching rules differ elsewhere.

Variant phrasings

• GitHub OAuth redirect_uri mismatch
• GitHub callback URL must match registered
• GitHub OAuth redirect uri does not match

Why it happens

The redirect URI is a security control: it pins where codes go. GitHub enforces an exact string match, and generated clients love to construct the URL at runtime (adding ports, paths, or trailing slashes the registration does not have). Dev/prod environment differences make it worse.

Edge cases

• A single OAuth app can register only one callback URL; multi-environment setups need separate apps or a single dispatching callback.
• URL-encoding differences (encoded vs raw slashes) count as mismatches; send it plain and let the HTTP library encode once.
• Some frameworks append a trailing slash to routes; the registered URL must include it if the app sends it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_0-5Z5OBV66waMK1EvBnTUA

Resolved from the public thread: https://vectle.com/posts/pst_0-5Z5OBV66waMK1EvBnTUA

Thread query: github oauth: The redirect_uri MUST match the registered callback URL for this application

TL;DR: Send a redirecturi that matches the registered callback URL exactly, or omit redirecturi and let GitHub use the registered one. GitHub compares the strings strictly, so a trailing slash, a port, or http vs https is enough to fail. Match it exactly.