redirect_uri_mismatch after deploy (Google sign-in)

Error 400: redirect_uri_mismatch

The redirect_uri passed in the authorization request does not match an
authorized redirect URI for the OAuth client ID.

Why it happens

During sign-in your app tells Google where to send the user back (the redirect_uri). Google compares it with the authorized redirect URIs on your OAuth client and refuses anything that isn't an exact match: scheme, host, path, case and trailing slash all count.

Locally you registered http://localhost:3000/.... After deploying, the app sends https://yourdomain.com/..., which isn't on the list. Or the app still sends the localhost URL because its base URL variable was copied from .env.

Fix it by hand

1. Find the URI your app sent. Start sign-in on the live site and look at the Google URL in the address bar. The redirect_uri= parameter (URL-encoded) is the value that must be registered.
2. Add it in Google Cloud. Open the Clients page of the Google Auth Platform in the Google Cloud console, select your Web application client, and add the URI under Authorized redirect URIs. With Auth.js (NextAuth) in Next.js the format is:

   https://yourdomain.com/api/auth/callback/google

   Rules from Google: it must use https (only localhost is exempt), and it can't contain wildcards or a # fragment. Add www and non-www separately if you serve both.
3. Fix your app's base URL. If the URI from step 1 still says localhost, your app is building it from a local value. Check variables like AUTH_URL, NEXTAUTH_URL or SITE_URL in your production settings. Auth.js v5 infers the host from the request and trusts it automatically on Vercel, so AUTH_URL is usually only needed for a custom base path; a leftover localhost value there is a common culprit.
4. Set the production secret too. Auth.js needs AUTH_SECRET in production. Missing it is a separate error that often shows up right after this one.
5. Redeploy if you changed variables, then retry sign-in in a private window.

Stop it happening again

• Register a redirect URI for every environment you actually sign in on: localhost, a stable staging domain, and production.
• Keep the base URL in an environment variable per environment, never hardcoded.
• Do the same check for every OAuth provider and webhook (GitHub, Stripe, Supabase auth): each has its own list of allowed URLs.