Fix “Google hasn't verified this app” on Bolt
Bolt usually builds a Vite single-page app and publishes it to a shared *.bolt.host subdomain, so your fix is about the domain you land on and the HTML that domain serves to Google's crawler.
A Bolt deploy lives on a *.bolt.host subdomain you can't prove you own (older projects sit on *.netlify.app via the legacy Netlify integration), and — like most Vite SPAs — it serves an empty HTML shell that only becomes your landing page after JavaScript runs. Google's reviewer sees a shared subdomain and a blank homepage.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Your app must run on a domain you own and have verified — the top private domain, like yourdomain.com. Google's review treats a shared platform subdomain like *.lovable.app or *.vercel.app as not yours.”
“Verify the domain in Search Console with the same Google account that owns the Cloud project; verifying under a personal account that isn't on the project fails silently.”
“Your homepage must return meaningful, server-rendered HTML to an automated fetch — a JS-only shell, a bot challenge, a robots block, or an invalid TLS certificate all read as 'unresponsive'.”
“Your homepage must describe what the app does and link to your privacy policy.”
“The app name on your OAuth consent screen must match your public site/app name — a name mismatch is one of the most common rejection triggers.”
“Publish the app from 'Testing' to 'In production' before submitting — Testing caps you at 100 users, shows the unverified screen, and expires refresh tokens after 7 days.”
Do these in order, on Bolt.
- 01
Attach a domain you own
Buy a domain and connect it in Bolt's project settings under Domains & Hosting (a paid Bolt plan is required). If your project still publishes through the legacy Netlify integration, attach the domain on that Netlify site instead. The goal is a domain you own, not a shared *.bolt.host address.
- 02
Verify the domain in Search Console
Verify it with the same Google account that owns your Cloud project — a personal account that isn't on the project verifies nothing Google can see.
- 03
Serve a homepage a crawler can read
Add a pre-rendered or static landing page that states what the app does and links your privacy policy in the initial HTML. Check with curl -A "Googlebot" https://yourdomain.com — you want real text, not just a script tag.
- 04
Match names and submit from production
Make the consent-screen app name identical to your site name, then publish the app to 'In production' before submitting.
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Bolt put me on a *.bolt.host subdomain — is that a problem?
Only for ownership. A shared *.bolt.host (or legacy *.netlify.app) address can't pass as a domain you own; attach a custom domain in Bolt's Domains & Hosting settings and the ownership requirement is met.
Do I need to change my app code?
Usually just the landing page: it has to return crawlable HTML that describes the app. The rest is Google Cloud configuration, not app logic.