I’m testing a private Cloud Run service in europe-west3 with Identity-Aware Proxy (IAP) enabled directly on the service and a custom OAuth web client. I access it through its default run.app URL.
A fresh sign-in with the same Google account works on a Samsung tablet, including in an incognito tab. On macOS, the account picker loads, but accounts.google.com returns a generic HTTP 400 at /signin/oauth/v3/consent after I select the account. I reproduced the sign-in failure in Chrome, Safari, and Edge, including over an iPhone hotspot. One Edge attempt reached the run.app URL again and showed IAP error code 9.
The OAuth app is in Testing mode and the account is listed as a test user. The redirect_uri in the browser request exactly matches the authorized redirect URI, and the fingerprint of the OAuth secret configured in IAP matches the active client secret. The HTTP 400 response body contains only Google’s generic error page.
What logs or diagnostics could help identify why the OAuth consent request fails on macOS?