Why does OAuth fail inside an in-app WebView?

Google blocks OAuth authentication inside embedded WebViews under its 'Use secure browsers' policy (the hidden URL bar prevents domain verification).

Google blocks OAuth authentication inside embedded WebViews under its 'Use secure browsers' policy (the hidden URL bar prevents domain verification). This surfaces as 'Error 403: disallowed_useragent' or a blocked screen, and also affects Fitbit's Google login.

Replace the WebView with a native in-app browser (Custom Tab or SFSafariViewController style) that shows the URL bar:

1

Open the Terra-generated auth URL in the native browser.

2

Handle the success and failure redirect URLs in your app.

Your existing widget integration and redirect handling can stay the same. See implementing the Terra widget for the auth flow.

For Google Fit, the web API connection is recommended over the SDK path for reliability.