You click "Sign in with Google" in an n8n credential and Google answers "Error 400: redirect_uri_mismatch". OAuth providers only send the user back to addresses you registered in advance. n8n sent one that is not on the list. The fix takes two minutes once you know which URL to copy and where to paste it.
In short. Copy the OAuth Redirect URL shown in the n8n credential and paste it exactly into the provider's authorised redirect URIs (for Google: Google Cloud Console > Credentials > your OAuth client). Protocol, domain, port and path must match character for character. If n8n shows http://localhost:5678/... while you reach it at an https domain, fix the instance's public URL first.
Step 1: copy the URL from n8n
Open the credential in n8n. The OAuth Redirect URL field shows the address n8n will send. On a self-hosted instance it looks like:
On n8n Cloud, use exactly the URL displayed in your credential.
Step 2: paste it in the provider console
For Google, as described in the n8n documentation:
- 1 Google Cloud Console > APIs & Services > Credentials.
- 2 Open your OAuth client of type Web application.
- 3 Under Authorized redirect URIs, add the URL copied from n8n.
- 4 Save, wait a minute, and retry the sign-in in n8n.
Other providers (Microsoft, HubSpot, Slack, Xero...) have the same field under names such as "Redirect URI" or "Callback URL".
Why it still does not match
| Difference | Example |
|---|---|
| Protocol | http:// registered, n8n sends https:// |
| Domain | n8n.example.com vs www.n8n.example.com |
| Port | localhost:5678 vs localhost |
| Trailing slash or path | /callback/ vs /callback |
| Wrong OAuth client | Credential uses a client ID from another project |
Compare the URL in the error details (Google shows the redirect_uri it received) with the registered one, letter by letter.
Self-hosted: n8n shows localhost or http
Behind a reverse proxy, n8n does not know its public address unless you tell it. If the OAuth Redirect URL in the credential shows http://localhost:5678, the provider will either reject it or redirect your browser to a dead address.
n8n builds the redirect URL from N8N_EDITOR_BASE_URL. If that is not set, it uses N8N_WEBHOOK_URL, and otherwise it combines N8N_PROTOCOL, N8N_HOST and N8N_PORT. Behind a proxy, the last option produces the internal address. Set the public URL explicitly, then restart:
Reopen the credential, check that the OAuth Redirect URL now shows your https domain, and register that one. Setting N8N_WEBHOOK_URL also fixes webhook addresses behind the same proxy (see n8n webhook URLs).
Local testing with Google
The n8n documentation notes that Google accepts localhost as a redirect URI for development, so a local instance at http://localhost:5678/rest/oauth2-credential/callback works without a domain or SSL, as long as you register exactly that URL.
Two related Google errors
- Access denied or "app not verified": the OAuth consent screen is in Testing mode and your account is not a test user. Add it under OAuth consent screen > Test users.
- invalid_client: the client ID or secret in n8n does not match the console. Copy both again and watch for spaces.
Worked example: Google Sheets on a self-hosted instance behind Caddy
Your n8n runs in Docker behind Caddy at https://n8n.example.com. Connecting a Google Sheets credential fails with redirect_uri_mismatch.
- 1 Open the credential in n8n and read the OAuth Redirect URL. It shows
http://localhost:5678/rest/oauth2-credential/callback. That is the problem: n8n does not know its public address. - 2 Set the public URL in the n8n environment and restart:
- 1 Reopen the credential. The OAuth Redirect URL now reads
https://n8n.example.com/rest/oauth2-credential/callback. - 2 Google Cloud Console: APIs & Services > Credentials > your OAuth client (type Web application) > Authorized redirect URIs > add that exact URL > Save.
- 3 Consent screen: if the app is in Testing mode, add your Google account under Test users.
- 4 Enable the API you need (Google Sheets API) in the same project.
- 5 Back in n8n, Sign in with Google.
Where to paste the URL, provider by provider
The field names differ; the rule does not.
| Provider | Where the redirect URL goes |
|---|---|
| OAuth client > Authorized redirect URIs | |
| Microsoft (Entra ID) | App registration > Authentication > Redirect URIs (Web) |
| Slack | App > OAuth & Permissions > Redirect URLs |
| HubSpot | App > Auth > Redirect URL |
| Xero | App > Redirect URIs |
Paste the URL copied from the n8n credential, not one typed from memory.
Errors that look similar
| Message | Real cause | Fix |
|---|---|---|
redirect_uri_mismatch | URL not registered exactly | Copy from n8n, paste in the console |
invalid_client | Wrong client ID or secret | Copy both again, no spaces |
access_denied, "app not verified" | Testing mode, user not a test user | Add the account as a test user |
invalid_scope | Scope not enabled for the app | Enable the API and scopes in the console |
| Works once, fails days later | Testing-mode tokens can expire; consent revoked | Publish the app or reconnect |
Frequently asked questions
What redirect URI should I use for n8n?
The exact OAuth Redirect URL shown in your n8n credential. On self-hosted instances it ends with /rest/oauth2-credential/callback.
Why does n8n show a localhost redirect URL on my server?
The instance does not know its public address. n8n builds the redirect URL from N8N_EDITOR_BASE_URL (or N8N_WEBHOOK_URL if it is not set). Set it to your public https URL and restart.
How long does Google take to accept a new redirect URI?
Usually a minute or less, sometimes a few minutes. Retry after saving.
Do I need a domain and SSL to use Google OAuth with n8n?
Not for local development: Google accepts localhost redirect URIs. In production, use your https domain.
Why does Google say "This app is blocked" when connecting n8n?
The OAuth app requests sensitive scopes and is not verified, or the account is not a test user. Add the account as a test user while in Testing mode.
Do I need a separate OAuth client for each n8n instance?
Each instance has its own redirect URL. You can register several redirect URIs on one client, or create one client per environment for clarity.
Does N8N_WEBHOOK_URL affect the OAuth redirect URL?
n8n builds the redirect URL from N8N_EDITOR_BASE_URL, and falls back to N8N_WEBHOOK_URL when the first is not set.
Tags
Steve founded PURIST, a workflow automation studio working with n8n, Make and Claude AI, and is the point of contact on every project. Prices and features in our articles come from vendor documentation and public pricing pages. How we research and score tools.
