"Error 403: disallowed_useragent": why Google sign-in fails inside Instagram and TikTok

Error 403: disallowed_useragent means Google refused the sign-in because the page is running inside an embedded browser — typically the in-app browser of a social app such as Instagram, TikTok or Facebook. Google does not allow its sign-in pages in embedded webviews. The fix for a visitor is to open the same page in Safari, Chrome or another full browser and sign in there.

Why Google blocks sign-in in embedded browsers

An embedded webview is a browser component inside another app. The app that hosts it can, in principle, observe or alter what happens on the page — including a sign-in form. Google announced in its June 2021 Developers Blog post that it would block Google account sign-in in all embedded webviews from September 30, 2021, and that affected sign-ins show a disallowed_useragent error. The policy behind it is older; the 2021 post extended it to every embedded webview.

The rule is about the browser component, not about the website. The same "Sign in with Google" button that works in Safari or Chrome can fail when the page was opened from a link inside a social app, because that app shows the page in its own embedded view.

If you're seeing the error: open the page in your browser

1. 1

   Look for an Open in browser option

   In the app's browser view, check the menu (often three dots) or the share button for Open in browser, Open in Safari or Open in Chrome. Wording and position vary by app and version.

2. 2

   If there isn't one, copy the address

   Use Copy link if offered, or select the visible address. Open Safari or Chrome yourself and paste it into the address bar.

3. 3

   Sign in again in the full browser

   Start the sign-in from the page in your browser. You may need to repeat steps you took inside the app, such as adding items to a cart.

If your visitors see it: what site owners can change

You can't switch the rule off — it's Google's — but you can stop visitors from reaching it unprepared.

1. 1Reproduce it first. Tap a link to your sign-in page from inside Instagram or TikTok on iPhone and Android, and note which combinations show the error. Some apps on some devices use a full browser tab instead of a webview, so results differ.
2. 2Warn before the button, not after the error. Detect known in-app browsers and, before the Google button, explain that sign-in works in Safari or Chrome, with a way to open or copy the link.
3. 3Offer a sign-in that doesn't depend on Google's page. Email and password, or a one-time code typed into the page, can work inside the embedded view, so visitors aren't forced to switch. A sign-in link sent by email is different: it opens wherever the mail app opens links, usually not inside the social app.
4. 4Keep the state. If a visitor switches browser, they start a new session there. Preserve what matters in the URL — the product, the plan, the campaign parameters — so they don't start from zero.

That is exactly the gap OpenOut's breakout flow is built for: it recognises supported in-app browsers and, before the visitor reaches your page, offers a way into their usual browser — an opening attempt on Android, a guided copy flow on iPhone. It can't guarantee the browser opens — apps decide that — so the copy fallback matters as much as the button. The Instagram and TikTok pages describe the flow per platform.

If you build the app: use the system browser for sign-in

For native apps, the standard is RFC 8252, OAuth 2.0 for Native Apps: run the authorization request in an external user agent such as the system browser or an in-app browser tab (Custom Tabs on Android, ASWebAuthenticationSession on iOS) rather than in an embedded webview. Google's blog post also describes a test parameter, disallow_webview=true, that developers could add to authorization requests to see whether their flow was affected.