Custom domain vs platform subdomain for Google OAuth verification
Before Google reviews anything else, it checks that you own the domain your app runs on. A shared platform subdomain fails that check — this is the vibe-coder blocker #1.
Addresses like something.lovable.app, something.vercel.app, something.bolt.host, or something.replit.app are shared subdomains owned by the platform, not by you. You can't verify ownership of a domain you don't control, so verification can't proceed — and the mistake that wastes a whole cycle is verifying under a personal Google account that isn't on the Cloud project.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Your app must run on a domain you own and have verified — the top private domain, like yourdomain.com. Google's review treats a shared platform subdomain like *.lovable.app or *.vercel.app as not yours.”
“Verify the domain in Search Console with the same Google account that owns the Cloud project; verifying under a personal account that isn't on the project fails silently.”
“Every domain in your OAuth config — homepage, privacy policy, terms, and all redirect URIs and JavaScript origins — must be listed in your authorized domains.”
“After you submit, changing the app name, logo, homepage, policy URL, or authorized domains restarts the review — freeze branding until you're approved.”
Do these in order.
- 01
Buy and connect a domain you own
Register a domain and point it at your app on whatever platform you use. From here on, homepage, privacy policy, terms, and redirect URIs should all live on this one domain.
- 02
Verify it in Search Console with the right account
Verify the domain in Google Search Console using the same Google account that is Owner/Editor on your Cloud project. A personal account that isn't on the project verifies nothing Google's review can see.
- 03
List every domain in authorized domains
Add the top private domain used by your homepage, policy, terms, and every redirect URI and JavaScript origin to your OAuth authorized domains. The redirect-URI domain is the one most often missed.
- 04
Freeze it before submitting
Once the domain and branding are set, don't change them mid-review — a change to authorized domains restarts the process.
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Can I verify my app on a free platform subdomain?
No. A *.lovable.app / *.vercel.app / *.bolt.host / *.replit.app address is owned by the platform, so you can't prove ownership. A custom domain is required.
I verified my domain but nothing changed — why?
You likely verified it under a Google account that isn't on your Cloud project. Re-verify with the same account that owns the project; otherwise it's a silent failure.