Fixing Google sign-in in a URL app (Error 403: disallowed_useragent)

Why Google blocks it

In a WebView the host app controls the page — it could inject JavaScript and read what you type. Since 2021 Google refuses OAuth requests from embedded WebViews and asks apps to use the system browser instead. Facebook and Apple impose similar limits on their logins in some cases, so plan for all social logins, not just Google.

Fix 1: open sign-in in a Custom Tab

A Custom Tab is Chrome running on top of your app with your toolbar colour. Google allows sign-in there because your app can't see inside it. The flow:

1. The app recognises the sign-in URL (accounts.google.com or your auth provider's domain) and opens it in a Custom Tab instead of the WebView.
2. The user signs in. Your auth server redirects to a URL your app owns — an App Link such as https://example.com/auth/app-callback.
3. Android hands that link to your app, which loads it in the WebView. Your server sets the session cookie there.

The catch: cookies set inside the Custom Tab live in Chrome, not your WebView, so step 3 must carry a one-time code that your site exchanges for a session inside the WebView. Firebase Auth, Supabase, Auth0 and Clerk can all be configured for a redirect flow like this.

Fix 2: give users another way in

The fastest fix needs no app change: put email + password or email magic link / one-time code next to the Google button, and hide the Google button when the site detects the app's user agent. The app mode snippet adds a CSS class you can use:

html.in-app .google-signin { display: none; }

Fix 3: native sign-in (needs app code)

Android's Credential Manager can show the native Google account picker and hand an ID token to your site through a JavaScript bridge. It's the smoothest experience but needs custom native code, so it's beyond what most URL to app converters do.

What not to do

• Don't change the user agent to pretend to be Chrome. It violates Google's policies, Google detects it, and your users get locked out without warning.
• Don't send users to an external browser and hope. They sign in there, but the app's WebView stays logged out.

Test checklist

• Fresh install, no accounts on the phone — does sign-in still complete?
• Sign out and back in; then force-close the app and reopen — still signed in?
• Try the password reset email link — does it open in the app or the browser, and does that matter for your flow?