# Cloud Run with IAP: Google sign-in returns HTTP 400 on macOS

**URL:** <https://discuss.google.dev/t/cloud-run-with-iap-google-sign-in-returns-http-400-on-macos/413490>\
**Category:** Serverless Applications\
**Tags:** cloud-run\
**Created:** [November 13, 2026, 2:14pm UTC](https://discuss.google.dev/t/cloud-run-with-iap-google-sign-in-returns-http-400-on-macos/413490 "2026-11-13T14:14:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Digitaler\_Lernbeglei](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/digitaler_lernbeglei/32/285393_2.png) [@Digitaler\_Lernbeglei](https://discuss.google.dev/u/Digitaler_Lernbeglei)\
**Post date:** [November 13, 2026, 2:14pm UTC](https://discuss.google.dev/t/cloud-run-with-iap-google-sign-in-returns-http-400-on-macos/413490/1 "2026-11-13T14:14:06Z")

</div>

I’m testing a private Cloud Run service in `europe-west3` with Identity-Aware Proxy (IAP) enabled directly on the service and a custom OAuth web client. I access it through its default `run.app` URL.

A fresh sign-in with the same Google account works on a Samsung tablet, including in an incognito tab. On macOS, the account picker loads, but `accounts.google.com` returns a generic HTTP 400 at `/signin/oauth/v3/consent` after I select the account. I reproduced the sign-in failure in Chrome, Safari, and Edge, including over an iPhone hotspot. One Edge attempt reached the `run.app` URL again and showed IAP error code 9.

The OAuth app is in Testing mode and the account is listed as a test user. The `redirect_uri` in the browser request exactly matches the authorized redirect URI, and the fingerprint of the OAuth secret configured in IAP matches the active client secret. The HTTP 400 response body contains only Google’s generic error page.

What logs or diagnostics could help identify why the OAuth consent request fails on macOS?