Authorized redirect URI for Google Cloud (must match exactly — fixes redirect_uri_mismatch):

Google Cloud Console → APIs & Services → Credentials → your OAuth client → Authorized redirect URIs → Add URI → paste the line above. If the app uses a different host than you expect, set environment variable APP_PUBLIC_URL to your public origin with no trailing slash (example: https://braininspirednetwork.cloud), then redeploy. Add both your custom domain and your *.onrender.com URL if you use both.