Invalid request when using Chrome Identity API / Google OAuth Screen in the extension: Custom URI scheme is not supported on Chrome apps

[jacekzlowocki]

Description

We are developing a Chrome extension that utilizes Chrome Identity API (chrome.identity.getAuthToken()) to provide Google Authentication via Google OAuth screen. It works perfectly fine on Chrome browser, but not on Brave.

It seems that Brave adds it's own Custom URI scheme when creating oauth request:
https://github.com/brave/brave-core/blob/9b9b01ac4a6eb7686ed971fc44bbded09b3d9175/patches/chrome-browser-extensions-api-identity-identity_get_auth_token_function.cc.patch#L97

Which is no longer supported by Google:
https://developers.googleblog.com/en/improving-user-safety-in-oauth-flows-through-new-oauth-custom-uri-scheme-restrictions/

Enabling "Allow Google login for extensions" flag doesn't make any effect - still the same result.

Steps to Reproduce

1. In an extension, call chrome.identity.getAuthToken({ interactive: true })

Or to see it with existing extension:

1. Install Meeting Timer for Google Meet extension in Brave
2. Open extension popup and click "Sign up with Google" (this calls chrome.identity.getAuthToken({ interactive: true }))
3. Invalid request OAuth page opens

Actual result:

Error 400: invalid_request
Custom URI scheme is not supported on Chrome apps.

Expected result:

Actual Google OAuth screen opens, like in Chrome browser:

Reproduces how often:

Every time

Brave version (brave://version info)

1.65.126 Chromium: 124.0.6367.118 (Oficjalna wersja) (x86_64)
e6a0dcfed2e939addb42f91900875679412fa5b7
macOS Wersja 14.4.1 (kompilacja 23E224)

Version/Channel Information:

• Can you reproduce this issue with the current release? Yes
• Can you reproduce this issue with the beta channel? Yes
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? No
• Does the issue resolve itself when disabling Brave Rewards? No
• Is the issue reproducible on the latest version of Chrome? No

[astabinski]

Facing the same issue 👍

[beease]

Same issue for me

[siegerts]

Also running into this issue.

[LuckJMG]

Same issue while trying to login on the google keep extension.

May be related to #15754.

[siegerts]

Just following up here to see if there are any updates?

[siegerts]

I put together a few posts on how to use the chrome.identity.launchWebAuthFlow as an alternative to chrome.identity.getAuthToken for enabling Google OAuth in Chrome extensions. Hopefully it helps.

• Configuring chrome.identity.launchWebAuthFlow for Google Sign In in the extension
• Setting up a Cloudflare Worker to handle the token exchange and refresh
• Handling the token revoke and refresh in the extension