Connect a Google Sheets OAuth2 credential (Custom OAuth2, self-hosted — Managed OAuth2 not available).
Describe the problem/error/question
Click “Sign in with Google,” approve permissions on Google’s consent screen, then land back on: “Error: Unauthorized. Failed to connect. The window can be closed now.” No further detail shown, even via “More details.”
Already ruled out:
Redirect URI mismatch — confirmed exact match between n8n’s OAuth Redirect URL and Google Cloud Console’s Authorized redirect URIs (was getting redirect_uri_mismatch before fixing this specifically; that error is now gone, this is a different one)
Client ID/Secret — recopied fresh from Google Cloud Console multiple times
Test user — added my own email under OAuth consent screen → Audience → Test users
N8N_PROXY_HOPS — tried both with and without this env var set, same result either way
Tried connecting from both localhost:5678 and via a Cloudflare Tunnel address, same failure both ways
Question: what else could cause a generic “Unauthorized” specifically at the callback stage, after Google’s own consent screen has already approved the request? Also, is there any way to get more detail out of n8n than just “Unauthorized” — logs, a debug flag, anything more specific?
What is the error message (if any)?
Error: Unauthorized
Failed to connect. The window can be closed now.
Please share your workflow
(Select the nodes on your canvas and use the keyboard shortcuts CMD+C/CTRL+C and CMD+V/CTRL+V to copy and paste the workflow.)
Share the output returned by the last node
N/A — the credential never successfully connects, so there’s no workflow output tied to this issue.Information on your n8n setup
@Rasheed_Alia So your getting past google’s screen, which means, n8n is rejecting it, not google, it’s either a base url mismatch, or a session mismatch. If the browser reaches your n8n instance on a seperate one than your editor base url, the returning cookie wont match.
What are your, N8N_HOST, N8N_PROTOCOL, N8N_WEBHOOK_URL, and N8N_EDITOR_BASE_URL set to? and how many proxy hops?
Hi @Rasheed_Alia
n8n 2.0 flipped the default of N8N_SKIP_AUTH_ON_OAUTH_CALLBACK from true to false, so on 2.31.6 the callback endpoint requires an authenticated session and returns a bare “Unauthorized” at the callback stage even after Google has approved. Set it back to true and restart the container:
N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true
That check throws without writing a log line, so raising the log level won’t get you more detail on it either.
See this:
n8n uses a state parameter to prevent CSRF attacks. If the browser cannot associate the returning callback with the original session that started the OAuth flow, n8n throws a generic “Unauthorized” error.
Ensure your WEBHOOK_URL environment variable exactly matches the URL you are using to access the n8n UI. If you are using the Cloudflare Tunnel, access n8n only via that HTTPS address, not via localhost.
If your Google Cloud Project is set to “Internal” (Google Workspace only) but you are signing in with a personal @gmail.com account (or vice versa), Google may approve the screen but the token exchange will fail if the app isn’t published.
You need to do this:
Go to OAuth Consent Screen in Google Cloud Console.
Ensure the User Type is set to External.
Ensure the Publishing Status is set to Testing (and your email is in the Test Users list) OR In Production (which requires verification for sensitive scopes, but works for basic ones).
n8n’s UI hides the specific OAuth error for security reasons. To see the actual response from Google (e.g., invalid_grant, invalid_client), you need to look at the Docker logs.
Open your terminal/Docker Desktop.
Run the following command to stream logs:
docker logs -f <your_n8n_container_name>
Trigger the “Sign in with Google” flow again.
Watch the logs at the exact moment you are redirected back to n8n. Look for a WARN or ERROR log from the OAuth2 or Credentials module. It will usually contain the raw JSON response from Google’s token endpoint.