How to fix Error 400: redirect_uri_mismatch in Google Cloud
Copy the redirect_uri shown in the error details, open your OAuth client under Google Auth Platform, Clients, and add that exact value under Authorised redirect URIs, then Save. It must match character for character, including http or https, the port and any trailing slash.
This is for anyone whose Sign in with Google stops at a Google page saying Access blocked and Error 400 redirect_uri_mismatch. It means the callback URL your app sent is not on the client's list. The fix takes a minute once you know which client and which exact URL, and both are in the error itself.
Before you start
You need Owner or Editor on the Google Cloud project that owns the OAuth client your app uses.
- Time
- About 2 minutes, plus a few minutes for Google to apply it
- Account
- Not walked yet
-
1
Read the error details
On the Google error page, click error details and find redirect_uri and client_id. Copy the redirect_uri value exactly.
You should see: A line reading redirect_uri= followed by your app's callback URL.
-
2
Open your project's clients
In the Google Cloud console, pick the project that owns the client, then open Google Auth Platform and click Clients.
You should see: A list of OAuth clients with their names, types and Client IDs.
-
3
Open the matching client
Click the client whose Client ID matches the client_id in the error details.
You should see: The client's page with Authorised JavaScript origins and Authorised redirect URIs.
-
4
Add the redirect URI
Under Authorised redirect URIs click Add URI and paste the redirect_uri you copied. Do not add or remove a trailing slash, and keep http or https as it was.
You should see: The new URI in its own field, with no error under it.
-
5
Save
Click Save at the bottom of the page.
You should see: A message that the client was saved, possibly with a note that it can take a few minutes to take effect.
-
6
Try signing in again
Wait a few minutes, open your app in a private window and sign in with Google again.
You should see: Google's account chooser or consent screen instead of Error 400.
If it does not work
The redirect_uri in the error starts with http although your site is on https. Your app builds the URL from the request and sits behind a proxy or load balancer. Fix the app so it knows it is on https (for example, trust the X-Forwarded-Proto header), rather than adding the http URL to production.
The client_id in the error is not in your project. Your app is using credentials from another project or an old client. Check the client ID in the app's environment and edit that client, or switch the app to the one you meant.
The field rejects the URI with an invalid redirect message. Redirect URIs must be absolute, with no wildcard and no fragment. Public addresses must use https; http is only accepted for localhost.
After the fix you see Access blocked: this app's request is invalid, or a 403 access_denied. That is a different problem. The app is likely still in Testing and you are not a test user. Add yourself on the Audience page or publish the app.
Questions
Where do I find the redirect URI Google is complaining about?
On the error page, click the link for error details (often labelled error details or Request details). It shows redirect_uri= followed by the URL your app sent. That is the value to add.
Why does it work on localhost but fail in production, or the other way round?
Each environment sends its own callback URL. http://localhost:3000/auth/google/callback and https://example.com/auth/google/callback are two different entries, and both must be on the client.
Does a trailing slash or http versus https really matter?
Yes. Google compares the string exactly. https://example.com/callback/ and https://example.com/callback are different, and so are http and https. An app behind a proxy that thinks it is on http is a common cause.
How do I know which client to edit?
The error details show client_id. Match it against the Client ID column on the Clients page. Editing a different client in the same project changes nothing.
I saved the URI and still get the error. Why?
Google says changes can take a few minutes, sometimes longer, to apply. Wait, then retry in a private window so an old redirect is not cached.
How we checked
Verified 11 Oct 2026 against the live interface on not walked yet.
Related guides
Ready to do it?
Run these 6 steps on your own Google Cloud page. Each step shows in a panel on the page, Next when you are ready.