I'm getting a redirect_uri_mismatch when deploying my Node.js app to Heroku using Google OAuth2

Question

I'm tasked with making a server using Node.js which will read emails from a Google account and parse the content from those emails into data we can store in a database. I'm using Google's googleapis package (v103.0.0) in NPM to authenticate/authorize with whichever account we'd like to use.

The issue comes when we try to switch accounts and have the user re-auth. During development on a local machine, the Auth process works as expected:

1. The client requests an Auth URL.
2. The server generates a new Auth URL and sends it back to the client.
3. The client redirects to that URL and the Google Consent Screen is shown.
4. The client is asked to choose between logged-in Google accounts.
5. The client authorizes the application and is redirected back to the server with a code.
6. The server uses the code to generate/save a token, which allows it to use the Gmail API.

However, after deploying to Heroku, the Google Consent Screen no longer allows the user to select an account. Instead, at step 3, it shows this message . In just about every other question related to this error, there's always additional information below the error code/message, but nothing's there for me. I made sure: (1) the domain I'm using in Heroku is verified on the Google Cloud Console, and (2) the redirect_uri within the Node.js application is passing the correct domain to the Auth URL, even while in production.

---

I can't provide the URL for privacy reasons, but let me know if there's any source code or Cloud Console info I should include.

Answer 1

It didn't take long after posting this question, but I realized I was using an incorrect OAuth 2.0 Client ID type. I was attempting to use "Desktop" when I should've been using "Web application" instead. Take a look at this image to see the difference.

When you select "Web application", you're given some new options: Authorized JavaScript origins, and Authorized redirect URIs. This is where you need to fill out the allowed URIs. Here's a sample of what that should look like.