OAuth Callback URL Mismatch with GitHub/Google Provider
OAuth authentication fails with error 'redirect_uri_mismatch' or callback page shows blank/error. Users cannot sign in via GitHub or Google because the configured redirect URL doesn't match.
OAuth providers validate that the redirect URL matches exactly what was registered. Any difference in protocol, domain, path, or query parameters will cause the mismatch error.
Error Messages You Might See
Common Causes
- Localhost used in development but https://mysite.com in production config
- Port number mismatch (localhost:3000 vs localhost:5173)
- Protocol mismatch (http vs https)
- Trailing slash differences in callback URL
- Using wrong site domain after deployment
How to Fix It
In Supabase dashboard > Authentication > Providers > GitHub/Google, set redirect URLs:
Development: http://localhost:5173/auth/callback
Production: https://yourdomain.com/auth/callback
Create both entries if supporting both environments. Ensure Vite dev server runs on the exact port configured.
Real developers can help you.
Nam Tran
10 years as fullstack developer
Daniel Vázquez
Software Engineer with over 10 years of experience on Startups, Government, big tech industry & consulting.
Dor Yaloz
SW engineer with 6+ years of experience,
I worked with React/Node/Python
did projects with React+Capacitor.js for ios
Supabase expert
Matthew Butler
Systems Development Engineer @ Amazon Web Services
Jaime Orts-Caroff
I'm a Senior Android developer, open to work in various fields
MFox
Full-stack professional senior engineer (15+years). Extensive experience in software development, qa, and IP networking.
Luca Liberati
I work on monoliths and microservices, backends and frontends, manage K8s clusters and love to design apps architecture
Vlad Temian
15+ years shipping production infrastructure for startups. Former CTO at qed.builders (acquired by The Sandbox).
Cursor ambassador and agentic tooling builder.
I've scaled systems, automated deployments, and built observability tools for AI coding workflows. I specialize in taking vibe-coded apps from broken prototype to production-ready: fixing Supabase auth/RLS, Stripe integrations, deployment pipelines, and cleaning up AI-generated spaghetti.
I build tools in this space (agentprobe, claudebin, micode) and understand both sides: how AI generates code and why it breaks.
https://blog.vtemian.com/
PawelPloszaj
I'm fronted developer with 10+ years of experience with big projects. I have small backend background too
Simon A.
I'm a backend developer building APIs, emulators, and interactive game systems. Professionally, I've developed Java/Spring reporting solutions, managed relational and NoSQL databases, and implemented CI/CD workflows.
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
Do I need HTTPS for callbacks?
Yes for production. Development with localhost HTTP is allowed. All production URLs must use HTTPS.
How do I use different URLs for dev and prod?
Register both URLs in the OAuth provider settings. Use environment variables to switch between them.