Wrong OAuth client type

You need an OAuth 2.0 Web Application client, not a Desktop or Mobile client. In Google Cloud Console, go to Credentials → Create Credentials → OAuth 2.0 Client ID and select Web Application. Add your redirect URIs (like http://localhost:3000/auth/callback and your production domain), then copy the Client ID and Secret to Supabase Authentication → Providers → Google.