[QA] Google Sheets OAuth blocked: Error 400 invalid_request on authorize

[joe-rlo]

Environment

hosted-staging (crab shack)

Version / Commit Hash

staging HEAD as of 2026-04-09

QA Test Date

2026-04-09

Feature Area

Extensions > Google Suite

Steps to Reproduce

1. Open Telegram chat with IronClaw bot
2. 2. Send a message starting with "bug:" to trigger the Google Sheet bug logger
3. 3. Bot attempts to authorize with Google
4. 4. OAuth flow redirects to Google Sign-In

Expected Behavior

Google OAuth completes and the bot gets write access to the shared Google Sheet.

Actual Behavior

Google blocks the authorization with two errors:

• "Access blocked: Authorization Error" - app doesn't comply with Google's OAuth 2.0 policy
• • Error 400: invalid_request with redirect_uri=http://0.0.0.0:18179/oauth/callback, flowName=GeneralOAuthFlow
    The redirect URI uses a 0.0.0.0 binding which Google rejects as invalid.

Logs / Screenshots

Screenshots captured in QA doc "Bug bash 4/9"

[henrypark133]

Fixed by PR in near ai infra: https://github.com/Near-One/ai-infra-agent-hosting/pull/180

[joe-rlo]

Bug bash 4/11 update: Still reproducible on v0.25.0 (fresh instance).

Artem retested the Google Sheets OAuth flow on hosted-staging with a fresh 0.25.0 instance. The error now shows as redirect_uri_mismatch rather than just invalid_request:

• "Access blocked: This app's request is invalid"
• Error 400: redirect_uri_mismatch
• redirect_uri=https://ironclaw-oauth-stg.up.railway.app/oauth/callback
• flowName=GeneralOAuthFlow

The staging OAuth callback URI (ironclaw-oauth-stg.up.railway.app) is not registered in Google Cloud Console, which is the root cause of the mismatch. This needs the staging redirect URI added to the Google OAuth client configuration.

[henrypark133]

@joe-rlo

Thank you so much for the detailed reporting. This is very helpful!

I just added the URI it should take around ~ 5 min.

[serrrfirat]

could we check if this has been resolved with the URI change?

[joe-rlo]

@serrrfirat while this sort of works now.

1. a concern was brought up that it is no longer on a TEE so the user info is exposed in logs
2. Google provides this error upon sign-in (see image)

[serrrfirat]

@henrypark133 is this expected because of registering with Google?

[henrypark133]

@henrypark133 is this expected because of registering with Google?

Yep unfortunately, the app is still not verified completely with Google.

It should work after bypassing it. If everything works right now. Lets close this and if the QA team can open a separate lower priority issue for Google App registration/verification that would be great.