GUIDE

"Error 400: redirect_uri_mismatch" on your live site

Your login button worked all week. You connected your real domain, and now Google shows a wall of text containing redirect_uri_mismatch. Nothing is broken in your app: Google is refusing to send people back to an address you never told it about.

What the error actually means

Signing in with Google is a round trip. Your site sends the visitor to Google, Google checks who they are, then sends them back to a return address your app provided. For safety, Google only allows return addresses you registered in advance. Your builder registered the preview address. Your live site is asking Google to return people to a different one, so Google stops.

The fix: three screens, five minutes

  1. Google Cloud Console. APIs & Services → Credentials → your OAuth 2.0 Client ID. Under "Authorised redirect URIs", add the exact return address your app uses on the live domain. Exact means the whole thing, including https and any path, with no trailing slash unless your app uses one. Keep the old preview entry too, so both keep working.
  2. Your database or auth provider (Supabase and similar). Set the Site URL to your live address, and add the live address to the list of allowed redirect URLs. This is the setting people miss, because the app appears configured while the auth service still points home.
  3. Your app's own settings. If any environment variable holds a site URL (names like SITE_URL, PUBLIC_URL, NEXTAUTH_URL), set it to the live address on the host, then publish again.

Google's changes can take a few minutes to take effect. If it still fails, read the error carefully: it names the exact address it received. Copy that string into the allowed list rather than typing what you think it should be, because the mismatch is usually a missing www, an http instead of https, or a stray slash.

The prompt to paste

Google sign-in on my live site fails with redirect_uri_mismatch. Tell me the EXACT redirect URI my app sends to Google in production, including protocol, domain and path, and where in the code it comes from. Then list every place that value must also be registered (Google Cloud Console, my auth provider's URL configuration, and any environment variable), and give me the exact string to paste into each. Do not change application code until I have checked those settings.

Worth checking while you're there: the same mismatch breaks password-reset and email-confirmation links, which fail silently because nobody is watching. Test one of each after the fix.

Plyo is the home for AI-built projects — every version saved, one click to undo, one click to publish, plus a safety check, visitor counts and backups. Free to start: 3 projects, no card needed.

Give your project a home