redirect_uri_mismatch: compare the exact callback URL with Google Cloud. invalid_client: verify the client ID and secret belong together. Access blocked: check audience, test-user list, and publishing status. Wrong callback host: verify NEXTAUTH_URL and reverse-proxy host/protocol settings. Restart or redeploy after changing environment variables.