Fix “Google hasn't verified this app” on Lovable
On Lovable this warning has three predictable root causes, and none of them are in your app's logic. Fix the domain, the homepage rendering, and the publishing status in that order and the screen clears.
Lovable serves a client-rendered React app on a *.lovable.app subdomain. Two things follow: you can't prove you own a shared platform subdomain, and the raw HTML Google fetches is an empty shell your browser only fills in later. Add a consent screen still stuck in 'Testing' and you have the exact trio behind almost every Lovable rejection.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Your app must run on a domain you own and have verified — the top private domain, like yourdomain.com. Google's review treats a shared platform subdomain like *.lovable.app or *.vercel.app as not yours.”
“Verify the domain in Search Console with the same Google account that owns the Cloud project; verifying under a personal account that isn't on the project fails silently.”
“Your homepage must return meaningful, server-rendered HTML to an automated fetch — a JS-only shell, a bot challenge, a robots block, or an invalid TLS certificate all read as 'unresponsive'.”
“Host your privacy policy on the same domain as your homepage — a Notion page or Google Doc on another domain is rejected.”
“The policy link on your homepage and the policy URL on your consent screen must point to the same policy.”
“Publish the app from 'Testing' to 'In production' before submitting — Testing caps you at 100 users, shows the unverified screen, and expires refresh tokens after 7 days.”
Do these in order, on Lovable.
- 01
Get onto a domain you own
Buy a domain and connect it in Lovable's domain settings (a paid plan is needed to attach one). Then verify that domain in Google Search Console using the same Google account that owns your Cloud project.
- 02
Make the homepage readable to a crawler
Give Lovable a real landing page whose text — what the app does, plus a visible privacy-policy link — is present before JavaScript runs. Confirm with: curl -A "Googlebot" https://yourdomain.com. If that returns an empty <div id="root">, Google saw a blank page.
- 03
Put the privacy policy on the same domain
Publish it at yourdomain.com/privacy (not a Notion or Google-Doc link) and use that exact URL both on the homepage and on the consent screen.
- 04
Publish to production, then submit
On the Google Auth Platform Audience page, move the app from 'Testing' to 'In production' and submit for verification. Testing is why your logins keep breaking after 7 days.
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Can I get verified while staying on my *.lovable.app URL?
No. Domain ownership is a prerequisite, and a shared platform subdomain can't be verified as yours — you need a custom domain connected to your Lovable project first.
My Lovable site loads fine in my browser — why does Google say the homepage is unresponsive?
Google's checker fetches raw HTML without running your JavaScript. A Lovable SPA returns an empty shell to that fetch even though your browser renders it perfectly. Serve a pre-rendered landing page to fix it.