Bolt
integration
Google OAuth Consent Screen Misconfigured in Bolt App
Users trying to log in with Google in your Bolt.new application encounter errors like 'This app isn't verified', 'Error 400: redirect_uri_mismatch', or a consent screen that requests terrifying permissions like 'See, edit, download, and permanently delete all your Google Drive files'. Some users see a blank screen after clicking 'Sign in with Google'.
Google OAuth is the most common social login provider, and a misconfigured consent screen will stop every user from signing up or logging in. The scary permission warnings or 'unverified app' screens cause users to immediately close the tab and never return, even if your app only needs basic profile information.
The issue stems from Google Cloud Console configuration not matching what your application code expects. Bolt generates the OAuth login flow in code but can't configure the Google Cloud Console for you, leading to mismatches between what Google expects and what your app sends.
Error Messages You Might See
Error 400: redirect_uri_mismatch
Error 403: access_denied - The developer hasn't given you access to this app
This app isn't verified - This app hasn't been verified by Google yet
Error 401: invalid_client - The OAuth client was not found
Error: popup_closed_by_user
Common Causes
- Redirect URI mismatch — The callback URL in your code doesn't exactly match what's registered in Google Cloud Console (wrong domain, missing path, http vs https)
- OAuth consent screen in testing mode — The app is in 'Testing' status which only allows pre-approved test users, blocking all other signups
- Excessive scopes requested — The code requests broad scopes like 'https://www.googleapis.com/auth/drive' when it only needs 'openid email profile'
- App not verified by Google — Production apps requesting sensitive scopes must go through Google's verification process
- Wrong OAuth client type — Created a Desktop or Android OAuth client instead of Web application type in Google Console
How to Fix It
- Fix redirect URI — In Google Cloud Console > APIs & Services > Credentials > your OAuth client, add your exact callback URL: https://yourapp.com/auth/callback/google (must match character-for-character)
- Publish the OAuth consent screen — Go to OAuth consent screen tab and click 'Publish App' to move from Testing to Production. This allows any Google user to sign in
- Request minimal scopes — Only request what you need. For login, use: scope: 'openid email profile'. Remove any Drive, Calendar, or other API scopes unless your app actually uses them
- Use correct client type — Delete the existing client and create a new one as 'Web application' type. Mobile and Desktop types don't support redirect-based OAuth flows
- Add all redirect URIs — Add both your development (http://localhost:3000/auth/callback/google) and production (https://yourapp.com/auth/callback/google) URIs
- Configure Supabase redirect — If using Supabase Auth, add https://your-project.supabase.co/auth/v1/callback to Google's authorized redirect URIs
Real developers can help you.
Basel Issmail
’m a Senior Full-Stack Developer and Tech Lead with experience designing and building scalable web platforms. I work across the full development lifecycle, from translating business requirements into technical architecture to delivering reliable production systems.
My work focuses on modern web technologies, including TypeScript, Angular, Node.js, and cloud-based architectures. I enjoy solving complex technical problems and helping teams turn product ideas and prototypes into working platforms that can grow and scale.
In addition to development, I often collaborate closely with product managers, business analysts, designers, and QA teams to ensure that solutions align with both technical and business goals.
I enjoy working with startups and product teams where I can contribute both as a hands-on engineer and as a technical partner in designing and delivering impactful software.
Jacek Rozanski
Senior PHP/Symfony developer and DevOps engineer with 20+ years of professional experience, running opcode.pl (web development agency, est. 2004).
Day job: I'm the sole backend developer at merketing company where I own and maintain 11 PHP/Symfony microservices on AWS (ECS Fargate, RDS, S3, CloudFront), handle the full CI/CD pipeline (Bitbucket Pipelines, Docker), and manage monitoring with Sentry and CloudWatch. These services handle high request volumes in production every month.
What I bring to AI-built apps:
- I audit and fix security issues (OWASP methodology), performance bottlenecks, and architectural problems in codebases generated by Cursor, Claude Code, Lovable, Bolt, and v0
- I refactor AI-generated prototypes into production-grade applications with proper error handling, testing, and clean architecture (SOLID, DDD, hexagonal architecture)
- I set up the infrastructure AI tools don't touch: AWS hosting, CI/CD pipelines, automated deployments, database optimization, monitoring, and alerting
- I integrate external services: payment providers, email systems, partner APIs, SSO/auth
Tech stack: PHP 8.x, Symfony, React, Next.js, PostgreSQL, MySQL, Docker, AWS (ECS, RDS, S3, SQS/SNS, CloudFront), Terraform, Supabase. I also use AI tools daily (Claude Code, Cursor) in my own workflow, so I understand both the strengths and the gaps in AI-generated code.
Based in Poland (CET timezone). Available for async work and calls during EU/US business hours.
Kingsley Omage
Fullstack software engineer passionate about AI Agents, blockchain, LLMs.
Luca Liberati
I work on monoliths and microservices, backends and frontends, manage K8s clusters and love to design apps architecture
ISHANTDEEP SINGH
Senior Software Engineer with 7+ years of experience in React, JavaScript, TypeScript, Next.js, and Node.js. I’ve also worked as a tech lead for startups, owning end-to-end technical execution including architecture, development, scaling, and delivery. I bring a strong mix of hands-on coding, product thinking, and technical leadership, and I’m comfortable building products from scratch as well as improving and scaling existing systems.
Anthony Akpan
Developer with 8 years of experience building softwares fro startups
Nam Tran
10 years as fullstack developer
Matt Butler
Software Engineer @ AWS
zipking
I am a technologist and product builder dedicated to creating high-impact solutions at the intersection of AI and specialized markets. Currently, I am focused on PropScan (EstateGuard), an AI-driven SaaS platform tailored for the Japanese real estate industry, and exploring the potential of Archify.
As an INFJ-T, I approach development with a "systems-thinking" mindset—balancing technical precision with a deep understanding of user needs. I particularly enjoy the challenge of architecting Vertical AI SaaS and optimizing Small Language Models (SLMs) to solve specific, real-world business problems. Whether I'm in a CTO-level leadership role or hands-on with the code, I thrive on building tools that turn complex data into actionable value.
Alvin Voo
I’ve watched the tech landscape evolve over the last decade—from the structured days of Java Server Pages to the current "wild west" of Agentic-driven development. While AI can "vibe" a frontend into existence, I specialize in the architecture that keeps it from collapsing.
My expertise lies in the critical backend infrastructure: the parts that must be fast, secure, and scalable. I thrive on high-pressure environments, such as when I had only three weeks to architect and launch an Ethereum redemption system with minimal prior crypto knowledge, turning it into a major revenue stream.
What I bring to your project:
Forensic Debugging: I don't just "patch" bugs; I use tools like Datadog and Explain Analyzers to map out bottlenecks and resolve root causes—like significantly reducing memory usage by optimizing complex DB joins.
Full-Stack Context: Deep experience in Node.js and React, ensuring backends play perfectly with mobile and web teams.
Sanity in the Age of AI: I bridge the gap between "best practices" and modern speed, ensuring your project isn't just built fast, but built to last.
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
How do I move my Google OAuth app from Testing to Production?
Go to Google Cloud Console > APIs & Services > OAuth consent screen. Click 'Publish App'. If you only use basic scopes (openid, email, profile), verification is automatic. If you request sensitive scopes, Google will review your app which can take weeks.
Why do users see 'This app isn't verified' warning?
Your OAuth consent screen is either in Testing mode (only test users can sign in) or you're requesting sensitive scopes that require Google verification. For most apps, requesting only 'openid email profile' scopes avoids verification requirements.