Google OAuth consent screen: setup, Internal vs External, and why it isn't showing

Where the consent screen settings are now

The old single "OAuth consent screen" page has been split into sections of the Google Auth Platform (Get started with the Google Auth Platform). As of Oct 2026:

Google's own setup instructions now start at Menu > Google Auth platform > Branding (Configure the OAuth consent screen). Once configured, the consent screen cannot be removed from the project.

Internal or External?

Sources: Manage App Audience, When is verification not needed.

Choose Internal for a company tool used only by your Workspace accounts. Choose External for anything public, and for any project created with a personal Gmail account, which has no organization.

Setup, step by step

As of Oct 2026, following Google's current flow (Configure the OAuth consent screen):

1. In the Google Cloud console, select your project and open Google Auth Platform. If it says "Google Auth platform not configured yet", click Get Started.
2. App Information: enter the App name and a User support email you monitor. Click Next.
3. Audience: choose Internal or External. Click Next.
4. Contact Information: enter the email Google should use for project notifications. Click Next.
5. Finish: accept the Google API Services User Data Policy, click Continue, then Create.
6. Data Access > Add or Remove Scopes: pick the narrowest scopes you need. For sign-in only, openid, .../auth/userinfo.email and .../auth/userinfo.profile are enough. Click Save.
7. Audience > Test users > Add users (External apps in Testing): add your own account and any testers. Click Save.
8. Branding: add the home page, privacy policy and terms links and your authorized domains (Manage OAuth App Branding).
9. Clients > Create Client: choose Web application, then add your Authorized JavaScript origins and Authorized redirect URIs. The client secret is shown only right after creation, so copy it then (Manage OAuth Clients).

The redirect URI depends on your auth library:

Auth.js (NextAuth v5)   https://example.com/api/auth/callback/google
Supabase Auth           copy the Callback URL from the Google provider page in the Supabase dashboard
                        (local development: http://127.0.0.1:54321/auth/v1/callback)
Firebase Auth           https://<your-auth-domain>/__/auth/handler

Sources: Auth.js Google provider, Supabase: Login with Google, Firebase redirect best practices. If Google rejects the URI later, see redirect_uri_mismatch.

Changes to origins and redirect URIs can take 5 minutes to a few hours to apply (Manage OAuth Clients).

Why the consent screen is not showing

1. The user already granted access

Google shows the consent screen when the user has not previously authorized your app. After that, sign-in usually goes straight back to your app (OpenID Connect). This is expected. To see it again while testing, either remove the app from the test account at myaccount.google.com/linkedapps (Google Account Help), or force it with prompt=consent, which shows consent every time.

2. Your code sets prompt or login_hint

prompt=none shows no screens at all and returns an error if the user isn't already signed in and consented. login_hint suppresses the account chooser. prompt=select_account forces the account chooser (OpenID Connect). Firebase passes prompt through setCustomParameters; its API reference lists hd, hl, include_granted_scopes, login_hint and prompt as valid Google parameters (Firebase GoogleAuthProvider reference). Set them per library:

// Firebase Web SDK: always show the account chooser
import { GoogleAuthProvider } from "firebase/auth";
const provider = new GoogleAuthProvider();
provider.setCustomParameters({ prompt: "select_account" });

// Auth.js (auth.ts): show consent every time and get a refresh token
import NextAuth from "next-auth"
import Google from "next-auth/providers/google"

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    Google({
      authorization: {
        params: { prompt: "consent", access_type: "offline", response_type: "code" },
      },
    }),
  ],
})

// Supabase: same idea
await supabase.auth.signInWithOAuth({
  provider: "google",
  options: { queryParams: { access_type: "offline", prompt: "consent" } },
})

Sources: Firebase: Authenticate using Google, Firebase GoogleAuthProvider reference, Auth.js Google provider, Supabase: Login with Google. Auth.js notes that forcing consent makes users confirm access on every sign-in, so use it deliberately.

3. Google shows an error page instead

If you see "Access blocked" rather than a consent screen, the request was rejected before consent. Read the error code: see Access blocked: This app's request is invalid for Error 400 codes, or App has not completed Google verification for the Testing-mode 403 access_denied block.

4. You can't find the page in the console

The settings moved into Google Auth Platform sections (table above; labels as of Oct 2026). If fields are read-only, check that you are in the right project and that your account has edit rights on it.

Consent screen verification

Two different reviews exist (Verification requirements):

• Brand verification applies to every app that wants its name and logo shown. Without it, users see only your application domain (Manage OAuth App Branding). As of Oct 2026, a Verify Branding button appears on the Branding page when needed; a successful check changes the status to Ready to publish, and you then click Publish branding. Uploading a new logo to a production External app triggers verification again.
• Scope verification applies only to sensitive or restricted scopes and adds a use-case review, demo video and, for restricted scopes, a security assessment.

Getting the app name and logo right is covered in Google sign-in app name.

How to confirm it worked

• In a private window with a test account, start sign-in: you see the account chooser, then the consent screen listing your requested scopes.
• The screen shows your app name and logo once brand verification is published; before that, it shows your domain.
• Sign in a second time without prompt=consent: Google skips consent, which confirms the grant was stored.

Related problems

• Name shows as a domain instead of your brand: Google sign-in app name
• Supabase configuration: Supabase Google OAuth setup