Configure and troubleshoot Google sign-in

Google button and OAuth client are separate layers

The Wavize button should keep readable size, icon and label. Google 401 invalid_client or “no registered origin” occurs after clicking and indicates incorrect Google Cloud configuration, not CSS distortion.

Sign-in uses a Web application OAuth client. Authorized JavaScript origins contain only scheme and host; redirect URIs contain the exact callback path supplied by application.

Do not confuse these examples
Origin: https://wavize.com. Redirect URI: full Wavize callback URL used by your route. A path placed in Origins is rejected.

Verify Wavize variables and Google project

Client ID configured in Wavize must belong to same client as secret and permissions.

1. Web application type

   In Google Cloud Console > APIs & Services > Credentials, open used client. Android or iOS client does not suit this web flow.

2. Exact Client ID

   Compare complete value including apps.googleusercontent.com suffix. An old production variable may point to a deleted project.

3. Server-side secret

   Secret must never appear in HTML or screenshots. After rotation, update server configuration and clear configuration cache.

Register authorized origins and redirects

Add each environment explicitly without unsafe wildcard.

1. JavaScript origin

   Add exactly https://wavize.com and, if actually used, https://www.wavize.com. No trailing slash or /auth/google/callback path.

2. Callback URI

   Copy the complete expected URI from production route. Scheme, host, path, slash and any locale prefix must match exactly.

3. Consent screen

   Check publishing state, authorized domains and test users when app remains in testing. An unlisted account may be blocked despite correct callback.

Distinguish symptoms

Failure timing indicates layer to inspect.

• Visually incorrect button

  Inspect CSS, container width, icon and responsive layout. Click may still open Google correctly.

• invalid_client

  Client ID missing, wrong project, mismatched secret or unloaded variable. Fix configuration before changing routes.

• no registered origin

  Add exact origin where button runs. Seeing accounts.google.com in address bar does not mean Google should be authorized as origin.

• redirect_uri_mismatch or 403

  Compare callback character by character and check consent screen, test users and Workspace policies.

Retest without masking the issue

Google propagation may take a few minutes.

1. Clear app cache

   Reload Wavize configuration after variable changes, then open private window.

2. Test existing account

   Use an already registered address: it should find same account without duplicate.

3. Test new signup

   Accept terms before redirect. New account receives verified email and enters onboarding.

Useful diagnostic evidence

Hide OAuth code, Client ID if your process requires, email and all secrets.

• Google message — Exact text and error code.
• Tested origin — Visible scheme and host, without callback parameters.
• Time and environment — Production or staging, browser and private window.