Google 403: add yourself as a tester
RJ-GA is unpublished, which is correct for a private dashboard. Google will only let Test users sign in. Add the same Gmail you use in the Google account picker — including aliases. You do not need to complete Google verification.
- Open Audience / Test users.
- Publishing status stays Testing. Click Add users and enter your Gmail.
- Save, wait about a minute, use an incognito window if Google still has the old session.
OAuth consent screen overviewRedirect URIs (already done if sign-in reached Google)
On the OAuth client, open Authorized redirect URIs — not JavaScript origins — add both URIs below, then Save. Client type must be Web application.
Redirecthttp://localhost:3000/api/auth/callback/google
Also addhttp://127.0.0.1:3000/api/auth/callback/google
Originhttp://localhost:3000
Open this OAuth client in Google CloudRead-only access to Google Analytics. After you save the redirect URIs in Google Cloud, wait about a minute before trying again.