Guides
Error 403 disallowed_useragent: Why Google Sign-In Fails in Your App, and What to Do
"Sign in with Google" works on your website and fails in your app with Error 403: disallowed_useragent. Here's what Google is doing, why the hacks don't last, and the sign-in methods that work reliably inside an app.
You turn your website into an Android app, open it, tap "Sign in with Google", and instead of the account picker you get a page that says "Access blocked: This app's request is invalid" and "Error 403: disallowed_useragent". The same button works perfectly in Chrome. This isn't a bug in your site or your app builder. It's a deliberate Google policy, and once you understand it the fix is straightforward.
Why Google blocks sign-in inside WebViews
Since 2021, Google has refused OAuth sign-in requests that come from embedded WebViews, the in-app browser component most apps built from websites use. The reason is security: inside a WebView, the app that hosts it can, in principle, read what the user types, including their Google password. Google only allows sign-in in a real browser (Chrome, or a Custom Tab, which is Chrome running inside the app) or through native Android sign-in APIs, where the app can't see the password.
Google detects WebViews from the browser's user agent, which is why the error mentions "useragent". Facebook applies a similar rule: it stopped supporting Facebook Login inside Android embedded browsers in 2021. Other providers vary, so test each one inside your app.
Who runs into this
- Apps made with any website-to-app converter that loads pages in a WebView.
- Apps made from AI-built web apps (Lovable, Bolt, Replit, Base44) that use Supabase, Firebase or Clerk with Google as a provider.
- Bubble, WordPress and Shopify sites that use social login plugins.
- Any site using Google One Tap or the Sign in with Google button inside an app.
What not to do: change the user agent
The first fix most forum threads suggest is to change the WebView's user agent so it pretends to be Chrome. Don't. It breaks Google's terms and the security reason behind them. Google has said it can detect embedded browsers in other ways, and it can stop working at any time, which locks out every user who signed up with Google. It's not worth building your login on.
Sign-in methods that work inside an app
| Method | Works in a WebView app? | Notes |
|---|---|---|
| Email and password | Yes | Supported by every auth provider. Make sure password managers can autofill your form. |
| One-time email code (OTP) | Yes | Best option for most apps. The user types a six-digit code, so nothing leaves the app. |
| Magic link | With setup | The link opens in the phone's browser by default, signing the user in on the website instead. Set up Android App Links so it opens in your app. |
| Phone number and SMS code | Yes | Common in markets where phone sign-in is the norm. SMS costs money per message. |
| Sign in with Google | No, in a WebView | Needs Custom Tabs or native Android sign-in, which means native code. |
| Facebook Login | No, in a WebView | Facebook blocks embedded browsers on Android. |
For most apps, the most reliable setup is email and password plus a one-time email code. Supabase, Firebase Auth, Clerk, Auth0 and most other auth providers support both, and AI builders like Lovable can add them for you if you ask. If you rely on magic links, read how to set up Android App Links so they open in the app.
What about users who already signed up with Google?
This is the tricky part if your website has been live for a while. Users who created their account with Google may never have set a password. Three ways to handle it:
- 1Turn on one-time email codes. A Google account always has an email address, so the user can sign in with a code sent to the same address, as long as your auth provider links accounts by email.
- 2Add a "set a password" option in account settings on the website, and mention it in the app's sign-in screen.
- 3Show a short note on the app's sign-in page, such as "Signed up with Google? Use the email code option", and hide the Google button inside the app with custom CSS so nobody hits the error.
With Capsule you can hide the Google button only inside the app by adding a CSS rule in the dashboard, which is injected into every page the app loads. Your website keeps its Google button for desktop and mobile browser users.
If you really need Google sign-in in the app
Some apps can't move away from Google, for example tools built on Google Workspace. The supported options all need native code: open the sign-in page in a Custom Tab with a library like AppAuth and pass the result back to your site, or use Android's Credential Manager for native Google sign-in and exchange the token with your backend. Both mean building and maintaining an Android project, for example with Capacitor. For most website-based apps, switching the in-app login method is far less work.
Why this matters for Google Play review
Play reviewers sign in to your app with the test account you provide. If that account uses Google sign-in, or the reviewer taps the Google button and gets a 403, the app is rejected for broken functionality. Give reviewers an email and password account under App access, and read why Google Play rejects WebView apps for the other common causes.
Frequently asked questions
- What does Error 403: disallowed_useragent mean?
- It means Google refused a sign-in request because it came from an embedded WebView rather than a real browser. Google does this on purpose to protect users' passwords.
- How do I fix Google sign-in in an Android WebView?
- Either use a different sign-in method inside the app, such as email and password or a one-time email code, or move Google sign-in to a Custom Tab or native Android sign-in, which needs native code.
- Can I change the user agent to get around it?
- You shouldn't. It goes against Google's policies, can stop working at any time, and would lock out every user who relies on it.
- Does Facebook Login work in a WebView app?
- No. Facebook stopped supporting its login in Android embedded browsers in 2021, so use email-based sign-in inside the app instead.
- Can I keep the Google button on my website but hide it in the app?
- Yes. With Capsule you add a CSS rule in the dashboard that hides the button inside the app only, and your website stays unchanged.