Google OAuth Brand Verification

Why This Matters

When users sign in with Google, they see an OAuth consent screen. By default, this screen may display:

• Supabase project URL (e.g. abcdefgh.supabase.co) instead of your domain
• "Unverified app" warning if your app is not verified
• Generic or missing app name and logo

This reduces trust and can make users hesitate to authorize. Verifying your brand and configuring a custom domain ensures users see your app name, logo, and domain — improving authorization rates and reducing revocations.

Two-Part Solution

To show your domain instead of Supabase on the consent screen, you need both:

1. Supabase Custom Domain — Use your domain for the OAuth callback (e.g. auth.yourdomain.com) so Google displays it instead of supabase.co
2. Google Brand Verification — Verify your app's identity with Google so your logo, name, and policies appear correctly and the "unverified app" warning is removed

Part 1: Supabase Custom Domain

The OAuth redirect URI is what Google shows on the consent screen. By default it is https://YOUR_PROJECT.supabase.co/auth/v1/callback. To show your domain, configure a custom domain for your Supabase project.

1.1 Add Custom Domain in Supabase

1. Go to Supabase Dashboard → your project → Project Settings → General
2. Find Custom Domains and add a subdomain (e.g. auth.yourdomain.com or api.yourdomain.com)
3. Add the CNAME and TXT records Supabase provides to your DNS
4. Wait for verification and SSL issuance (up to ~30 minutes)

1.2 Update Google OAuth Redirect URIs

1. Go to Google Cloud Console → APIs & Services → Credentials
2. Open your OAuth 2.0 Client ID (Web application)
3. Under Authorized redirect URIs, add:
   • https://auth.yourdomain.com/auth/v1/callback (or your custom domain)
4. Keep the existing Supabase URL during transition, then remove it after testing
5. Save

1.3 Update Your App

Set NEXT_PUBLIC_SUPABASE_URL to your custom domain:

NEXT_PUBLIC_SUPABASE_URL=https://auth.yourdomain.com

Also add the custom domain to Supabase Authentication → URL Configuration → Redirect URLs (e.g. https://yourdomain.com/auth/callback).

Part 2: Google Brand Verification

Brand verification tells Google who your app is and verifies your domains. It typically takes 2–3 business days after submission.

2.1 When Verification Is Required

Your app requires verification if:

• You want a logo or display name on the OAuth consent screen
• Your app is set for External users (anyone with a Google Account)

Testing mode (up to 100 test users) does not require verification.

2.2 Configure OAuth Consent Screen

1. Go to Google Cloud Console → APIs & Services → OAuth consent screen
2. Select External user type (or Internal for Workspace-only apps)
3. Fill in:
   • App name — Your product name
   • User support email — Your support email
   • App logo — 120×120 px (required for verification)
   • App domain:
     • Application home page — https://yourdomain.com
     • Application privacy policy — https://yourdomain.com/privacy
     • Application terms of service — https://yourdomain.com/terms (optional)
   • Authorized domains — Add yourdomain.com (and auth.yourdomain.com if using custom Supabase domain)
   • Developer contact information — Email for Google to reach you
4. Click Save and continue

2.3 Verify Domains in Google Search Console

Google requires domain ownership verification. For SEO indexing (sitemaps, crawl data), see Google Search Console Setup.

1. Go to Google Search Console
2. Add your domain (e.g. yourdomain.com)
3. Verify ownership using one of the methods (DNS TXT, HTML file, or meta tag)
4. Use a Google Account that has Owner or Editor on the Cloud project
5. Repeat for any subdomains used (e.g. auth.yourdomain.com if different from main domain)

2.4 Declare Scopes

1. In OAuth consent screen → Scopes, click Add or remove scopes
2. Add only the scopes your app needs. For basic Google Sign-In, Supabase typically uses:
   • openid
   • .../auth/userinfo.email
   • .../auth/userinfo.profile
3. Avoid sensitive or restricted scopes unless necessary — they can trigger longer verification

2.5 Submit for Verification

1. Go to OAuth Verification Center
2. Select your project
3. Click Submit for verification
4. Provide any requested documentation
5. Wait for Google's Trust & Safety team (typically 2–3 business days)
6. Respond promptly to any follow-up emails

2.6 Home Page and Privacy Policy Requirements

• Home page must be publicly accessible and clearly describe your app
• Privacy policy must:
  • Disclose how you access, use, store, and share Google user data
  • Be hosted on the same domain as your app
  • Be linked from the OAuth consent screen
• NextBento includes legal pages at /privacy and /terms — customize them for your app

Checklist Summary

Exceptions (No Verification Needed)

You can skip verification if your app is:

• Personal use — Only you or a few known users
• Testing — In Testing mode with up to 100 test users
• Internal — Google Workspace org only (Internal user type)
• Service-owned data only — Uses service accounts, no user data

Next Steps

• Supabase Setup — Configure Google OAuth provider
• Authentication — Auth flow overview
• Legal Pages — Customize privacy policy and terms