NextAuth redirect URI mismatch when using custom API path /api/v1/auth

[akashdeep023]

I’m using NextAuth.js with a custom base path /api/v1/auth.
Everything works perfectly in local development, but in production (Vercel) I get a Google OAuth error: redirect_uri_mismatch even though the redirect URL in the Google Cloud Console matches exactly what NextAuth generates locally.

Environment

• Framework: Next.js 15
• Auth library: next-auth@4.24.11
• Deployment: Vercel
• Provider: Google OAuth

.env

NEXTAUTH_URL="https://mydomain.vercel.app/api/v1/auth"
NEXTAUTH_SECRET="super-secret"

app/provider.ts

"use client";
import { SessionProvider } from "next-auth/react";

export default function AppProvider({
	children,
}: {
	children: React.ReactNode;
}) {
	return (
		<SessionProvider basePath="/api/v1/auth">
			<ThemeProvider
				attribute="class"
				defaultTheme="light"
				enableSystem
				disableTransitionOnChange
			>
				{children}
			</ThemeProvider>
		</SessionProvider>
	);
}

File structure
/app/api/v1/auth/[...nextauth]/route.ts

Expected Behavior
Google OAuth should redirect correctly to:
https://mydomain..vercel.app/api/v1/auth/callback/google

Actual Behavior
After sign-in, the redirect URL generated by NextAuth is:
https://mydomain..vercel.app/api/auth/callback/google

Images

[AndryRoby]

The config you've got (full path in NEXTAUTH_URL + basePath on SessionProvider) is exactly what the docs say to do, so on paper it's right. A few things I'd check before assuming NextAuth itself is broken, in order of how often this turns out to be it:

1. Is NEXTAUTH_URL actually set on the Production environment in Vercel, not just Preview/Development? Vercel scopes env vars per environment, and it's easy to add one, see it work on a preview deploy, and never notice it's missing from Production. vercel env ls shows which environments each var is attached to.
2. If it is set on Production, did you trigger a fresh deploy after adding or changing it? Serverless builds on a couple of hosts keep serving a stale bundle until a real redeploy runs.
3. Check there isn't a leftover route file still sitting at app/api/auth/[...nextauth]/route.ts from before you moved to the custom path. If both that file and your new app/api/v1/auth/[...nextauth]/route.ts exist, whichever one actually receives the request wins, and that looks identical to "NEXTAUTH_URL isn't working" until you go looking for it.

If all three check out and it's still sending /api/auth/callback/google instead of /api/v1/auth/callback/google, that's a real bug worth its own issue with the (redacted) Vercel env var scope shown.

I built a free client-side tool that diffs whatever redirect_uri your app actually sends against your Google Cloud Console entries byte by byte, handy for confirming exactly which layer is still wrong once you've ruled out the above: https://arling.sk/google-oauth-redirect-doctor/