security//OAuth 2.0//callback URL

The callback URL is the redirect address where Google sends the authorization code after the user consents, which is how Google knows where to deliver the handshake. It is registered in the Google Cloud Console when the credentials are set up, as the place where the code goes when a user of the app says yes.

The callback URL is the redirect address where Google sends the authorization code after the user consents, which is how Google knows where to deliver the handshake. It is registered in the Google Cloud Console when the credentials are set up, as the place where the code goes when a user of the app says yes.

In a Supabase setup the callback URL points to Supabase's auth endpoint, and Supabase handles the code exchange automatically. Supabase's callback URL is copied into Google's configuration, and Google's Client ID and Client Secret into Supabase's, so the two can shake hands. It is the link that makes the whole OAuth chain work, once per user:

1The frontend triggers the popup2Google asks the user3The user says yes4Google sends a code to this URL5Supabase exchanges it for tokens and creates the user

If the callback URL does not match exactly, Google rejects the entire flow: no partial matches, and no wildcards in production.