Authentication method: OAuth2 User-Agent Flow, provider: Google (Gmail API)
Setup:
- App ID / App Secret: from a Google Cloud OAuth 2.0 “Web application” client (regenerated the secret once already, to rule out a stale value)
- Scope: https://www.googleapis.com/auth/gmail.send
- Authentication goes in the header: checked (Header Key: "Authorization: Bearer ")
- Add access_type=offline (Google APIs): checked
- Use a generic redirect URL: checked → https://[tu-dominio]/api/1.1/oauth_redirect (registered exactly as-is in Google Cloud Console’s Authorized redirect URIs)
- Login dialog redirect: https://accounts.google.com/o/oauth2/v2/auth
- Access token endpoint: https://oauth2.googleapis.com/token
- User profile endpoint: https://www.googleapis.com/oauth2/v2/userinfo
What happens:
I run the app with ?debug_mode=true, trigger a “Signup/login with a social network” workflow action tied to this connection, go through Google’s consent screen, and accept. Google redirects back to /api/1.1/oauth_redirect successfully. I land back in my app, but with:
“API Connector error: the Oauth2 API [Gmail API] is not configured properly - Received error from api. The service Gmail API just returned an error (HTTP 401)… ‘Invalid Credentials’ / ‘authError’ (sometimes ‘missing required authentication credential’, depending on the attempt).”
Clicking “Initialize call” on any Action in this connection fails the same way, in ~250-400ms — too fast to represent a real popup/handshake, suggesting it’s reusing a token that was never actually obtained.
What I’ve ruled out:
- App ID / App Secret — regenerated the secret in Google Cloud, re-pasted, still fails
- Header Key — manually retyped "Authorization: Bearer " with trailing space
- Scope — confirmed complete, not truncated
- Popup blocking — no blocked-popup icon in the address bar
- Browser/editor cache — hard refresh, brand new preview tabs each time
- Revoked + re-granted the Google permission from scratch multiple times — identical result every time
- Rebuilt the entire API Connector collection from scratch (new collection, every field re-entered) — identical result
- Tested in both Development and Live
Evidence from the Network tab:
Watching the OAuth redirect chain in DevTools, Google DOES successfully redirect back to my /api/1.1/oauth_redirect endpoint with a valid one-time authorization code in the query string (confirmed present, HTTP 302). So the authorization step completes correctly — App ID, redirect URI, and scope are all accepted by Google. The failure has to be happening in the server-side exchange of that code for an access token, which I can’t inspect from the browser since it’s server-to-server.
What I need: since that exchange happens on Bubble’s infrastructure, could someone check the server logs for this app around a fresh test attempt, to see what Google’s token endpoint is actually returning during that exchange? Happy to reproduce it again and give an exact timestamp.
Thanks!