name: supabase-oauth-redirect-debug
description: Debug OAuth redirect issues on Supabase Cloud — localhost redirects, site_url config, and Google OAuth flow problems
tags: ["supabase", "oauth", "google", "authentication"]
Supabase OAuth Redirect Debugging
Problem: OAuth redirects to http://localhost:3000 instead of production domain
Symptoms
After clicking "Sign in with Google", Google redirects to http://localhost:3000/#access_token=eyJ... instead of the correct production URL.
Root Cause
The Supabase project's site_url is empty or unset. Supabase defaults to http://localhost:3000.
Fix (Management API)
`bash
curl -s -X PATCH "https://api.supabase.com/v1/projects/
-H "Authorization: Bearer
-H "Content-Type: application/json" \
-d '{
"site_url": "https://your-production-domain.com",
"uri_allow_list": "https://your-production-domain.com/*"
}'
`
Personal Access Token from: https://supabase.com/dashboard/account/tokens
Verification
Check returned JSON has:
- -
"site_url": "https://your-production-domain.com" - -
"uri_allow_list": "https://your-production-domain.com/*"
Problem: Google blocks login with "This browser or app may not be secure"
Google blocks automated/headless browsers with "This browser or app may not be secure". Can only be tested manually in a real browser. OAuth config is correct if the Google sign-in page URL contains redirect_uri=https://.
Problem: Google OAuth redirect URL missing from Google Cloud Console
Google shows "401. That's an error. The OAuth client was not found."
Fix: console.cloud.google.com → APIs & Services → Credentials → OAuth 2.0 Client ID → Authorized redirect URIs → add:
`
https://
`
Verification Checklist
1. site_url set via Management API PATCH ✅
2. uri_allow_list includes https://your-domain.com/* ✅
3. Google Cloud Console has redirect URL https:// ✅
4. App's OAuth redirectTo is ${window.location.origin}/auth/callback ✅
5. Manual browser E2E test (automated browsers blocked by Google) ✅