QAlaunch

Bolt.new Google sign-in not working: causes and fixes

Google sign-in in a Bolt.new app fails for three reasons: the origin or redirect URI in Google Cloud does not exactly match what Bolt's Authentication screen shows, you are testing inside the Bolt preview where Google blocks the sign-in window, or the Google app is still in Testing mode and only lets listed users in. Copy the values from Bolt into your OAuth client, add your custom domain as an origin, test on the published site and publish the app in Google Auth Platform.

Opens your site in a real browser on desktop and phone. Free, about two minutes, no signup. Full report from $19.

What you'll see

Clicking Continue with Google shows "Error 400: redirect_uri_mismatch", or nothing happens at all when you click inside Bolt. On the published site it works for you and a colleague but strangers get "Access blocked" or a message that the app has not completed verification.

Why it happens

1. Origin or redirect URI does not match

Google compares the request against the exact list in your OAuth client. A missing https, a trailing slash, the bolt.host address listed but not your custom domain, or a typo in the redirect URI is enough for Google to refuse.

2. Testing inside the preview iframe

Bolt's help center notes that Google's OAuth flow blocks iframes, so sign-in will not work in the Bolt Preview window. It looks broken there even when the setup is correct.

3. The Google app is still in Testing

New OAuth apps start in Testing mode, which Google limits to up to 100 users. Anyone outside that group is turned away until you publish the app.

How to fix it

  1. In Bolt, click the database icon, open Authentication > Continue with Google and switch on Enable Google Sign In. Note the authorised JavaScript origin and the redirect URI it displays.
  2. In Google Cloud Console, open your project's OAuth client (Web application). Paste the redirect URI into Authorized redirect URIs exactly, and the bolt.host address into Authorized JavaScript origins.
  3. Add your custom domain, with https:// and no trailing slash, as a further Authorized JavaScript origin. Bolt's docs note you may need several origins depending on your domain setup.
  4. Copy the Client ID and Client Secret from Google into the matching fields on Bolt's Continue with Google screen and save.
  5. Publish the Bolt project and open the published URL in a new browser tab. Test sign-in there, never in the preview pane.
  6. In Google Auth Platform, fill in Branding and then use Audience to publish the app to production so any Google account can sign in.

Prompt to paste into Bolt.new

Make Google sign-in redirect back to window.location.origin after login, and show any OAuth error message on screen instead of failing silently. Do not change any other auth behaviour.

How to check it's fixed

  • On the published custom domain, in a private window, sign in with a Google account that was never added as a test user.
  • Repeat on a phone, and confirm you land back on your site signed in rather than on an error page.

What a QAlaunch scan shows for this

  • Console errors and failed requests on the public sign-in page.
  • A sign-in button that is the main call to action but leads to an error page, which the CTA check reports.
  • The scan never signs in with a Google account, so it cannot complete the flow; it shows what happens up to that point.

See exactly what a full report contains in the sample report.

Frequently asked questions

Why does Google sign-in do nothing in the Bolt preview?

The preview runs inside an iframe, and Google blocks its sign-in flow from loading in one. Publish and test in a normal browser tab.

What is redirect_uri_mismatch?

Google received a redirect address that is not in your OAuth client's list. Copy the redirect URI from Bolt's Authentication screen character for character, including https and any path.

Do I need Google to verify my app?

Plain sign-in does not need scope verification, but you do need to publish the app under Audience to leave Testing mode. Verification is only required if you request extra Google data such as Drive or Calendar access.

Done for you · not automated

Rather have a QA engineer test it by hand?

If this is a site you're launching or handing to a client, I'll go through it by hand, including the Bolt.new-specific issues a scan can't reach, like logged-in flows.

$299one-time · 3 business days
  • Up to 10 key pages tested by hand, not a scan
  • Every flow a customer uses: forms, sign-up, checkout, booking
  • Real mobile and desktop browsers
  • A written report in plain language, with screenshots
  • A 15-minute call to walk you through it
  • 10 years of professional QA experience

Tell me about your site and I'll reply personally, usually the same day.

No payment now. I'll confirm scope and price first.

Related fixes

More for Bolt.new: all Bolt.new fixes · Bolt.new testing · 9 bugs every AI-built site ships with

Written by Waqas Ahmad, QA engineer with 10 years of professional testing experience. Last checked October 26, 2026.

Sources: Bolt help center: Google sign-in · Bolt help center: login issues