Google OAuth Consent Screen Misconfigured in Bolt App
Users trying to log in with Google in your Bolt.new application encounter errors like 'This app isn't verified', 'Error 400: redirect_uri_mismatch', or a consent screen that requests terrifying permissions like 'See, edit, download, and permanently delete all your Google Drive files'. Some users see a blank screen after clicking 'Sign in with Google'.
Google OAuth is the most common social login provider, and a misconfigured consent screen will stop every user from signing up or logging in. The scary permission warnings or 'unverified app' screens cause users to immediately close the tab and never return, even if your app only needs basic profile information.
The issue stems from Google Cloud Console configuration not matching what your application code expects. Bolt generates the OAuth login flow in code but can't configure the Google Cloud Console for you, leading to mismatches between what Google expects and what your app sends.
Error Messages You Might See
Common Causes
- Redirect URI mismatch — The callback URL in your code doesn't exactly match what's registered in Google Cloud Console (wrong domain, missing path, http vs https)
- OAuth consent screen in testing mode — The app is in 'Testing' status which only allows pre-approved test users, blocking all other signups
- Excessive scopes requested — The code requests broad scopes like 'https://www.googleapis.com/auth/drive' when it only needs 'openid email profile'
- App not verified by Google — Production apps requesting sensitive scopes must go through Google's verification process
- Wrong OAuth client type — Created a Desktop or Android OAuth client instead of Web application type in Google Console
How to Fix It
- Fix redirect URI — In Google Cloud Console > APIs & Services > Credentials > your OAuth client, add your exact callback URL: https://yourapp.com/auth/callback/google (must match character-for-character)
- Publish the OAuth consent screen — Go to OAuth consent screen tab and click 'Publish App' to move from Testing to Production. This allows any Google user to sign in
- Request minimal scopes — Only request what you need. For login, use: scope: 'openid email profile'. Remove any Drive, Calendar, or other API scopes unless your app actually uses them
- Use correct client type — Delete the existing client and create a new one as 'Web application' type. Mobile and Desktop types don't support redirect-based OAuth flows
- Add all redirect URIs — Add both your development (http://localhost:3000/auth/callback/google) and production (https://yourapp.com/auth/callback/google) URIs
- Configure Supabase redirect — If using Supabase Auth, add https://your-project.supabase.co/auth/v1/callback to Google's authorized redirect URIs
Real developers can help you.
Stanislav Prigodich
15+ years building iOS and web apps at startups and enterprise companies. I want to use that experience to help builders ship real products - when something breaks, I'm here to fix it.
Richard McSorley
Full-Stack Software Engineer with 8+ years building high-performance applications for enterprise clients. Shipped production systems at Walmart (4,000+ stores), Cigna (20M+ users), and Arkansas Blue Cross. 5 patents in retail/supply chain tech. Currently focused on AI integrations, automation tools, and TypeScript-first architectures.
Jared Hasson
Full time lead founding dev at a cyber security saas startup, with 10 yoe and a bachelor's in CS. Building & debugging software products is what I've spent my time on for forever
Matt Butler
Software Engineer @ AWS
AUXLE
I am a Full Stack Developer experienced in building Websites, Web apps and Cross Platform Mobile Apps for Startups and Companies.
Bastien Labelle
Full stack dev w/ 20+ years of experience
Basel Issmail
’m a Senior Full-Stack Developer and Tech Lead with experience designing and building scalable web platforms. I work across the full development lifecycle, from translating business requirements into technical architecture to delivering reliable production systems.
My work focuses on modern web technologies, including TypeScript, Angular, Node.js, and cloud-based architectures. I enjoy solving complex technical problems and helping teams turn product ideas and prototypes into working platforms that can grow and scale.
In addition to development, I often collaborate closely with product managers, business analysts, designers, and QA teams to ensure that solutions align with both technical and business goals.
I enjoy working with startups and product teams where I can contribute both as a hands-on engineer and as a technical partner in designing and delivering impactful software.
Anthony Akpan
Developer with 8 years of experience building softwares fro startups
Meïr Ankri
Full-stack developer specializing in React / Next.js / Node.js with 6+ years of experience. I've worked across various sectors including automotive (Reezocar/Société Générale), healthcare (Medical Link SaaS), and e-commerce (Glasman). I build web apps end-to-end, from architecture to production, with a focus on scalability, performance, and code quality. I also mentor junior developers and contribute to technical decisions and code reviews.
Franck Plazanet
I am a Strategic Engineering Leader with over 8 years of experience building high-availability enterprise systems and scaling high-performing technical teams. My focus is on bridging the gap between complex technology and business growth.
Core Expertise:
🚀 Leadership: Managing and coaching teams of 15+ engineers, fostering a culture of accountability and continuous improvement.
🏗️ Architecture: Enterprise Core Systems, Multi-system Integration (ERP/API/ETL), and Core Database Structure.
☁️ Cloud & Scale: AWS Expert; architected systems handling 10B+ monthly requests and managing 100k+ SKUs.
📈 Business Impact: Aligning tech strategy with P&L goals to drive $70k+ in monthly recurring revenue.
I thrive on "out-of-the-box" thinking to solve complex technical bottlenecks and am always looking for ways to use automation to improve business productivity.
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
How do I move my Google OAuth app from Testing to Production?
Go to Google Cloud Console > APIs & Services > OAuth consent screen. Click 'Publish App'. If you only use basic scopes (openid, email, profile), verification is automatic. If you request sensitive scopes, Google will review your app which can take weeks.
Why do users see 'This app isn't verified' warning?
Your OAuth consent screen is either in Testing mode (only test users can sign in) or you're requesting sensitive scopes that require Google verification. For most apps, requesting only 'openid email profile' scopes avoids verification requirements.