Search code examples
oauth-2.0google-oauth

Error in oAuth2 Google APIs - invalid_request "You can't sign in to this app because it doesn't comply with Google's OAuth 2.0 policy"

I have a project in Google cloud and an oauth2 client (web application) created for the same. As mentioned in the Google docs for using oAuth2 I first sent a HTTP GET to get the authorization code.

https://accounts.google.com/o/oauth2/v2/auth?scope=<my_scope>&access_type=offline&include_granted_scopes=true&response_type=code&state=state_parameter_passthrough_value&redirect_uri=https%3A//localhost%3A7082/signin-google&flowName=GeneralOAuthFlow&client_id=<my_client_id>

This step seems to work fine as I am getting the authorization code for the same scope I requested.

The next step where I send the authorization code to get the access token

POST https://oauth2.googleapis.com/token
code:<code_retrieved_from_previous_step>
client_id:<my_client_id>
client_secret:<my_client_secret>
redirect_uri:https%3A//localhost%3A7082/signin-google
grant_type:authorization_code

always fails with the error:

{
  "error": "invalid_request",
  "error_description": "\nYou can't sign in to this app because it doesn't comply with Google's OAuth 2.0 policy for keeping apps secure.\n\nYou can let the app developer know that this app doesn't comply with one or more Google validation rules.\n  "
}

Few things to note:

  1. My project is still in 'Testing' stage and I suppose things like branding checks, verification etc can be paused for now. I am using only the test users to sign in.
  2. I tried creating a new project and a new set of client_id and client_secret but the error remains.
  3. I also went through the OOB deprecation that was done a while back but I think it doesn't affect web applications.
  4. I tried the /token step with JSON payload as well as url_encoded format but result is same

I don't understand which policy is being violated here. Is there a way to understand the root cause here?

Solution

  • It looks like you are URL-encoding the redirect URL in the POST request when you shouldn't.

    While it's true that the POST data can use the application/x-www-form-urlencoded content type, the URL-encoding there is usually happening by the library you use for sending the request. If you also encode it, it would cause issues, resulting in the URL being broken and not matching what's configured on Google's side.