Google API authentication: Not valid origin for the client

Question

When making an auth request to the Google API (gapi), it's returning false on the checkOrigin.

I have removed any client id's or anything that would link directly to my account and replaced it with a regex indicating what the data is for reference.

Url: https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Flocal.tools&client_id=(\d{21})

My origin url is a local url, which is https://local.tools

Result: {valid: false}

I'm using the example found here without deviation (except for replacing clientid with my 21 digit clientid): https://ga-dev-tools.appspot.com/embed-api/third-party-visualizations/

The items I'm trying to display show up nicely on the demo site, but aren't getting past the Not valid origin for the client error on my local.tools site.

and "https://local.tools" is deffo configured in the API console and your local server is running on port 80? Try editing your /etc/hosts to point your demo site URL to 127.0.0.1 and see what happens. — pinoyyid, Mar 06 '17 at 22:37
Nothing good would happen because my development environment is not on 127.0.0.1. It also doesn't matter what port it's running on. It can be used on other ports besides port 80. — Francis Lewis, Mar 20 '17 at 14:57
Google API authentication: Not valid origin for the client. --- It might be in case, while you are **using same email id** for creating client id and for sign-in through webpage — Sahil Mujawar, Oct 09 '20 at 10:58

score 179 · Answer 1 · answered Jan 25 '18 at 02:33

179

Clear your browser cache. Started getting this error in Chrome and then I created a new client id and was still getting the issue. Opened firefox and it worked, so I cleared the cache on Chrome and it started working.

answered Jan 25 '18 at 02:33

iamcootis

2,203
3
18
22

27

Cannot believe cache plays that much role in it. – Adarsh Khatri Aug 06 '18 at 23:40
I had issue like this in iOS safari. The origin was accepted in chrome on iOS but not updated in safari. I’m hoping it will time out sooner or later. – Simon_Weaver Dec 10 '18 at 06:03
2

Or go take a break for an hour or so. Especially if on a device where you don’t want to clear all cache or on mobile where it’s harder to do so. – Simon_Weaver Dec 10 '18 at 07:59
2

Amazingly enough, clearing the browser cache actually solved this issue for me as well... – dorian Dec 11 '18 at 13:41
1

Perfect! It works for me after clearing the cache, Thanks a lot. – Mohan Jan 05 '19 at 10:35
I had this problem too. If you go to the settings on the dev tools in chrome, there is an option to disable the cache when the dev tool is open. – www139 Jan 24 '20 at 20:19
Love it when the solution to all my problems is clearing the cache :) – Sajad Torkamani Apr 11 '20 at 11:16
Gotta love it when you question your code and sanity, but all you needed to do is clear the cache. THANK YOU! – Max Pekarsky Jun 15 '20 at 21:52
Just a tip in case you don't want to lose all your cookies, history, etc. In chrome you can enter as a different user - so just enter as guest, so you wont have to delete all your browsing history. – Guy Nir Jul 08 '21 at 12:16

score 80 · Accepted Answer · answered Mar 06 '17 at 19:25

80

I received the same console error message when working with this example: https://developers.google.com/analytics/devguides/reporting/embed/v1/getting-started

The documentation says not to overlook two critical steps ("As you go through the instructions, it's important that you not overlook these two critical steps: Enable the Analytics API [&] Set the correct origins"), but does not clearly state WHERE to set the correct origins.

Since the client ID I had was not working, I created a new project and a new client ID. The new project may not have been necessary, but I'm retaining (and using) it.

Here's what worked:

Create a new project
Add and Enable the Analytics API
Create a new credential - ensure that it is an OAUTH credential (scroll to the bottom of this page for instructions https://developers.google.com/api-client-library/javascript/start/start-js#Setup).

During creation of the credentials, you will see a section called "Restrictions Enter JavaScript origins, redirect URIs, or both". This is where you can enter your origins.

Save and copy your client ID (and secret).

My script worked after I created the new OAUTH credential, assigned the origin, and used the newly generated client ID following this process.

answered Mar 06 '17 at 19:25

designdit

851
7
7

1

Yes, that was what I needed. Thank you! Seems like it should be obvious now, but the docs are a bit hard to follow. – Francis Lewis Mar 09 '17 at 17:58
2

if I test with a localhost, how can I add the oauth there? for example If I need to let access to http://localhost:9000/en/login – rosu alin Mar 15 '17 at 09:19
You don't need to worry about the oAuth callback. When you use the example given, there is a little button that says something along the lines of "google Authenticate" or I don't remember. But it's there and you click on it and a popup window comes up to authenticate. Adding my domain to the origins is what I needed to do, including after uploading the example to the server. I had to add the server URL to the origin domains. – Francis Lewis Mar 20 '17 at 14:55
3

My script worked with new credential in the old app. I believe this is a bug from Google, because I did try adding my origin to my old credential. – Franklin Yu Jul 04 '17 at 21:53
1

Had the same issue and these steps worked for me! The trick was Enabling the Analytics API before creating the Credentials – Sahan Serasinghe Aug 03 '17 at 03:27
In my case it was the type OAuth needed to fix – Arman Fatahi May 28 '18 at 14:03
Year after year I keep findig myself back at this answer. Nothing works --> Delete app --> Create new app with the domain added to whitelist --> It works. I mean, I get it, "have you tried turning it off and on again" is a meme for a reason. But it's incredibly frustrating that Google just refuses to improve these services, and there is no way to contact an actual helpful support-person instead of a generic chatbot. Oh well. See you here in 2021 I guess. – Andrew Feb 25 '20 at 14:56
Make sure you add the URIs when creating the credentials not after. – Victor Michael Kosgei Jul 07 '20 at 12:01
It seams 2021 is worse : setup that was working before does not work now. It seams you cannot enter "localhost" origin anymore. It says "not valid origin" – Fabien Quatravaux Feb 08 '21 at 09:37
Original article behind the link: https://web.archive.org/web/20170301044410/https://developers.google.com/api-client-library/javascript/start/start-js You can find the credential page here: https://console.cloud.google.com/apis/credentials/ edit the entry to define your JS source URLs (origins). – Martin Braun Aug 11 '21 at 13:00
Activate Analytics API here: https://console.cloud.google.com/apis/library/analytics.googleapis.com?project=xxx – Nino Nov 22 '22 at 10:48

score 23 · Answer 3 · answered Aug 06 '18 at 12:34

23

try clear caches and then hard reload, i had same error but when i tried to run on incognito browser in chrome it worked.

answered Aug 06 '18 at 12:34

Salman Saleem

439
4
14

4

Worth noting a normal hard refresh with a shift f5 or ctrl f5 didn't do the trick on chrome until I pressed F12 to open the console tab, then right-clicking on the Refresh and click on "Empty cache and Hard Reload" – usernotnull May 10 '20 at 09:40

walter · Answer 4 · 2020-05-09T15:44:50.963

18

Key Point: Add both http://localhost and http://localhost:port_number to the Authorized JavaScript origins box for local tests or development.

edited May 09 '20 at 15:44

answered May 09 '20 at 15:39

walter

539
5
5

1

Hi - where do you set this? – Steve Tomlin Dec 08 '20 at 19:22
check this Steve: https://developers.google.com/identity/one-tap/web/guides/get-google-api-clientid – walter Dec 10 '20 at 00:52
1

This worked for me. I had originally only listed http://localhost:port. Once I added http://localhost (without the port) alongside the one with port, it immediately started working. – JoshKraker Mar 19 '21 at 01:01
1

Yes! Add BOTH http://localhost and http://localhost: – jobima Feb 21 '22 at 23:13
1

What if my port number varies, can I use a wildcard to allow all ports on localhost? – Martin Braun Sep 10 '22 at 21:44

TitanFighter · Answer 5 · 2020-09-10T16:06:24.393

17

Credentials do not work if API is not enabled. In my case the next steps were needed:

Go to https://console.developers.google.com/apis/library
Enter 'People'
From the result choose 'Google People API'
Click 'Enable'

edited Sep 10 '20 at 16:06

answered Jan 06 '18 at 02:00

TitanFighter

4,582
3
45
73

This saved my day ..!!! The error seems totally unrelated but this worked – Clain Dsilva Mar 26 '19 at 18:20
After many hours this solve my problem. – GIA Jan 01 '22 at 21:24

score 14 · Answer 6 · answered Jan 31 '22 at 02:20

14

You probably use Client ID like this: <CLIENT_ID>.apps.google.com

Make sure your client ID is without ".apps.google.com"

answered Jan 31 '22 at 02:20

ejlp12

374
2
4

This worked for me. I think the reason it works is that the original URL that has `client_id=.apps.google.com` in the query params is cached by Google for quite a while, whereas the one with the updated ClientID is not (even though the two should be the same). – qff Jan 31 '22 at 21:18
This is the only solution here that worked for me. – Collie Feb 02 '22 at 20:46
2

In my case i had to remove ".apps.googleusercontent.com" and magically it started working. – Hemendra Singh Feb 02 '22 at 23:53
Thank you, you saved me a lot of time! – MehranTM May 01 '22 at 21:43

score 12 · Answer 7 · answered Dec 13 '18 at 05:33

12

Creating new oauth credentials worked for me

answered Dec 13 '18 at 05:33

sudharsan tk

494
6
14

1

Before I looked in SO I thought "maybe it's the cache".. after deleting the cache didn't work, This solution did. – Hagai Wild Jun 07 '20 at 19:50
1

your solution worked for me. kind of weird from google – Raimundo Nov 23 '21 at 13:47
Even I created a new client Id and it worked for me – KarthikNayak98 Jan 22 '22 at 16:13

score 11 · Answer 8 · answered Jul 26 '17 at 13:39

11

For me - I just went here:

https://console.developers.google.com/apis/credentials

Then chose the right project; then choose the credential with the same ID shown in your console error message. When editing the credentials you can add multiple origins to the white list.

answered Jul 26 '17 at 13:39

Reece

641
7
18

Nice, this is the correct answer for new client address – Lucas Andrade Apr 17 '21 at 01:59

Binh Ho · Answer 9 · 2021-12-08T01:42:24.663

7

After updated Authorized JavaScript origins browser still caching old data, so I need to Empty cache and hard reload then it works

1. Change Authorized origins

2. Open Dev Tool (F12) then right-click into reload button

edited Dec 08 '21 at 01:42

answered Sep 23 '21 at 09:42

Binh Ho

3,690
1
31
31

score 4 · Answer 10 · answered Aug 19 '21 at 13:12

Clearing the cache on chrome works!

Please find the steps below to clear the cache.

Open dev tools (Right-click on the page and select inspect/ press F12)
Right-click on the chrome reload button while the dev tool is opened. (You will find the option to clear the cache and reload the site)

score 3 · Answer 11 · edited Nov 20 '20 at 09:19

3

clearing the cache works for me.

for React developers try to restart the project otherwise it will show the same error again and again.

edited Nov 20 '20 at 09:19

Netch

4,171
1
19
31

answered Nov 20 '20 at 08:41

zacknight95

51
1
9

David · Answer 12 · 2021-05-04T10:55:22.073

It was a referrer-policy problem.

This has been such a pain for a long time to me too...

Found the issue, my website instance had a referrer policy set to no-referrer. After setting it to no-referrer-when-downgrade, the One Tap prompt showed up as expected.

https://stackoverflow.com/a/63039142/15565029

If you are using Django, SECURE_REFERRER_POLICY is 'same-origin' by default. Change it by adding the below code in your settings file.

# settings.py
SECURE_REFERRER_POLICY = 'no-referrer-when-downgrade'

https://docs.djangoproject.com/en/3.2/ref/settings/#std:setting-SECURE_REFERRER_POLICY

score 1 · Answer 13 · answered May 19 '21 at 09:34

Similar to few answers at above but with screenshots. If you created project for Firebase, may also use the same steps to configure at Google Cloud Platform console.

Select the project at https://console.cloud.google.com/
Navigate to Credentials
Click Edit button for the related OAuth 2.0 Client ID
Add URI into Authorized JavaScript origins
Don't forget to Save

Murat Demirsoy · Answer 14 · 2021-12-13T19:50:13.043

That worked for me after trying for an hour:

On https://console.cloud.google.com/apis/credentials :

Edit Client Outh (mine was: Web Client (Auto Created by Google Service), which was created by my Firebase Web Project)
Enter JavaScript Origin for the Client ID (mine was: localhost:NNNN) and don't forget to Save.
Try google login for half an hour: didn't work
Enabled Google Analytics as suggested above
Empty Chrome cache and hard reload as suggested above
Try google login for half an hour: didn't work
Sign Out from https://console.cloud.google.com, and sign in again
Empty Chrome cache and hard reload
Now it worked

I don't know which one of the above fixed the problem. May be it was just a matter of time for cloud.google to recognize my new JavaScript Origin.

score 0 · Answer 15 · answered Nov 22 '18 at 06:40

0

I got the error because of Allow-Control-Allow-Origin: * browser extension.

answered Nov 22 '18 at 06:40

Der_Meister

4,771
2
46
53

score 0 · Answer 16 · answered Jul 25 '20 at 23:56

0

Trying on a different browser(chrome) worked for me and clearing cache on firefox cleared the issue.

(PS: Not add the hosting URIs to Authorized JavaScript origins in API credentials would give you Error:redirect_uri_mismatch)

answered Jul 25 '20 at 23:56

sandy

1

score 0 · Answer 17 · answered Aug 23 '22 at 11:20

0

I was getting the same error but tried publishing my app and now it shows as below:

answered Aug 23 '22 at 11:20

Rahul

33
5

score 0 · Answer 18 · answered Mar 27 '23 at 16:20

I came across this error recently while developing a Capacitor JS Application, and here's a checklist of everything I had to do to resolve it. This list is compiled with answers from other users, as well as a few I found myself.

Clear cache and hard refresh
Use Chrome/Another Chromium browser (Error messages are sometimes different)
Make sure the Google Auth Client is set to In Production and not In Testing
Make sure to add JavaScript URIs pointing to your web address
Add both http://localhost and http://localhost:PORT to the URI list
If in development/testing and your URI is localhost, make sure to access the website from localhost and not from your machine IP
Try enabling the Google People API
Make sure you have access to the scopes you're using
If website has a "no-referrer" policy, switch to "no-referrer-when-downgrade"
Disable Ad blockers, Script blockers, and Brave Shields

Google API authentication: Not valid origin for the client

18 Answers18

1. Change Authorized origins

2. Open Dev Tool (F12) then right-click into reload button

It was a referrer-policy problem.

Linked