Why it happens
Since 2016 Google's OAuth endpoints reject requests whose user agent identifies an embedded WebView (WKWebView, Android WebView), because the host app could observe the credentials. The result is the "Error 403: disallowed_useragent" page. Facebook and some other providers apply similar rules. Email/password and magic-link logins are unaffected; only the OAuth redirect to the provider is.
The fix with WebViewGold
One setting per provider, no change in Supabase, Firebase or Base44.
Find the OAuth URLs your app uses
Start the Google login in a desktop browser and note the domains the redirect goes through (accounts.google.com for Google, m.facebook.com / www.facebook.com for Facebook).
Enter them as trigger prefixes
iOS: in Config.swift set google_login_helper_triggers and facebook_login_helper_triggers to those prefixes. Android: use the matching login helper settings in Config.java (see the setup documentation).
Test inside the app
When a trigger URL loads, WebViewGold opens the provider's page in a dedicated login window with an accepted user agent, completes the OAuth steps and returns to your web app with the session established.
Sign in with Apple needs nothing
The appleid.apple.com flow is detected and handled automatically. Just enable the Apple provider in your backend and add the button.
Alternative: open the auth URL externally
For edge cases, hand the login URL to the system browser with the googlelogin:// scheme; the session then lives in the browser and returns via your redirect URL.
Backend-specific notes
- Supabase (Lovable, Bolt, Tempo, Horizons): make sure the Site URL and Redirect URLs in Authentication settings include your production domain; the helper returns to that URL.
- Firebase (Softgen, Firebase Studio, Databutton): prefer signInWithRedirect over signInWithPopup inside the app; pop-ups are blocked by default in WebViews.
- Base44, Create, Mocha, Replit Auth: the built-in Google login goes through the same accounts.google.com URLs; the helper handles it.
- Apple Guideline 4.8: once Google login works, add Sign in with Apple (or an equivalent) on iOS; see the login guide for Lovable apps.
Frequently asked questions
Can I just change the user agent to look like Safari?
Setting a custom user agent is a supported WebViewGold option and solves it for some providers, but Google can still detect embedded contexts. The Social Login Helper is the reliable solution and keeps your identifying user agent for the rest of the app.
Does the session persist after the helper window closes?
Yes. The helper returns to your web app in the main view with the cookies and tokens set, and WebViewGold persists them across launches.
Does this work for GitHub, Microsoft or Discord login?
Add their OAuth domains as trigger prefixes in the same way. Any provider that blocks WebViews can be routed through the helper.