AuthOAuthDeploy

Error 400: redirect_uri_mismatch (Google / GitHub OAuth)

Error 400: redirect_uri_mismatch

In short: The callback URL your app sent isn't exactly one of the redirect URIs registered for that OAuth client.

Why it happens

OAuth providers compare the redirect URL character by character: protocol, domain, port, path, and trailing slash all count. It usually breaks after deploy because only http://localhost:3000/... was registered. With Supabase Auth, the provider must redirect to Supabase's callback, and Supabase's URL Configuration must list your site.

How to fix it

1. Copy the redirect_uri value from the failing URL (it's in the query string of the provider's error page).
2. Add that exact value under Authorized redirect URIs in the provider console (Google Cloud → Credentials, or GitHub → OAuth Apps).
3. Using Supabase Auth: the provider redirect URI is https://<project-ref>.supabase.co/auth/v1/callback; then add your app URLs under Supabase → Authentication → URL Configuration (Site URL + Redirect URLs).
4. Using Auth.js / NextAuth: set the app's base URL env var for production and register https://yourdomain.com/api/auth/callback/<provider>.
5. Wait a few minutes. Google can take time to apply changes.

Copy-paste fix prompt

I'm getting this error in my app:

Error 400: redirect_uri_mismatch

[Paste the full error, stack trace, and the file it points to here]

Likely cause: The callback URL your app sent isn't exactly one of the redirect URIs registered for that OAuth client.

Task: Work out exactly which redirect URI my app sends in production and in development, given my auth library and config, and list the exact values I need to register with the provider and (if used) Supabase URL Configuration.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, Lovable, Bolt, v0. Last reviewed 2026-11-13.