App Engine deployment shows unauthorized configuration error for Vertex AI Search widget

Other Questions AI Agent
1

I’m working on a Flask application that uses Vertex AI Search and deploying it to Google App Engine. Everything seems to work locally but I’m running into authorization issues when deployed.

My Flask application structure:

app.py

from flask import Flask, render_template
import os

webapp = Flask(__name__)

@webapp.route("/", methods=['GET', 'POST'])
def home():
    return render_template("search.html")

if __name__ == '__main__':
    webapp.run(host="0.0.0.0", port=int(os.environ.get("PORT", 8080)), debug=True)

search.html

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8">
    <title>Document Search Portal</title>
  </head>
  <body>
    <h1>Enterprise Search Tool</h1>
    <script src="https://cloud.google.com/ai/gen-app-builder/client?hl=en_US"></script>
    
    <gen-search-widget
      configId="45b73024-yyyy-yyyy-yyyy-yyyy91c6yyyy"
      triggerId="searchTrigger">
    </gen-search-widget>
    
    <input placeholder="Enter search terms" id="searchTrigger" />
  </body>
</html>

app.yaml

runtime: python39

The Flask app deploys fine and loads the main page. When I click the search input field, it opens the Vertex AI search interface. However, I get this error message:

Configuration is not authorized on “myproject.uc.r.appspot.com”

The search widget works perfectly when testing locally. Has anyone encountered this authorization problem when deploying Vertex AI Search widgets to App Engine? What configuration steps am I missing for the production environment?

2

Check your Vertex AI Search engine config in Google Cloud Console. Go to Agent Builder, pick your search engine, then find domain authorization settings under Integration. Add your App Engine domain myproject.uc.r.appspot.com to the allowed domains list. When this happened to me, I added both HTTP and HTTPS versions. The widget’s doing origin validation against authorized domains for security - that’s why you’re getting the error. It works locally because localhost is usually pre-authorized. After you update the domain list, wait 10-15 minutes for changes to propagate before testing.

3

I’ve hit this exact issue multiple times with App Engine deployments. Domain authorization is definitely your problem.

First time this happened, I learned you need to add the domain exactly as your app serves it. Make sure you’re adding myproject.uc.r.appspot.com - no extra paths or parameters.

What worked for me: Go to Google Cloud Console → Agent Builder → select your search app → Integration tab. Find “Allowed domains” and add your domain there.

Here’s the gotcha that got me - the interface can be picky about protocol prefixes. Try adding just the domain name first, then the full https URL if that doesn’t work.

Also check your App Engine service account permissions. The default service account sometimes needs “Discovery Engine Editor” role for proper Vertex AI Search authentication, especially beyond basic queries.

After making changes, wait about 15 minutes before testing. Propagation isn’t instant - I’ve wasted time thinking my fix failed when I just needed to be patient.

4

This authorization error usually comes from CORS restrictions in your Vertex AI Search setup. The widget does strict origin validation for security, and App Engine domains aren’t trusted by default. I ran into the same thing. The fix is in your search engine config. Go to Google Cloud Console → Agent Builder (used to be Discovery Engine) → pick your search engine → hit the “Integration” tab. You’ll see “Allowed domains” or “CORS settings” where you need to add your App Engine URL. Add the exact domain format from your error message. Sometimes you need both the bare domain AND the https version as separate entries. Changes take a few minutes to kick in. Also check if your project has the right IAM permissions for the App Engine service account to access Vertex AI Search. The default service account might need extra roles depending on how you’ve got things set up.

5

Had this exact issue a few months back when deploying a search widget to App Engine. It’s a domain authorization problem.

You need to whitelist your App Engine domain in the Vertex AI Search console. Go to your search app config and add your production domain to the allowed origins.

The widget checks the requesting domain against a whitelist for security. Since myproject.uc.r.appspot.com isn’t authorized, it blocks your requests.

Here’s what fixed it for me:

  1. Open Vertex AI Search console
  2. Find your search app (config ID 45b73024-yyyy-yyyy-yyyy-yyyy91c6yyyy)
  3. Go to Integration or Domain settings
  4. Add myproject.uc.r.appspot.com to authorized domains
  5. Also add https://myproject.uc.r.appspot.com if there’s a separate field for full URLs

Takes 5-10 minutes to propagate after saving. Your local environment works because localhost is usually whitelisted by default.

If you’re planning a custom domain later, add that too before switching over.

6

Yeah, it’s a domain whitelist issue. Same thing happened to me last week. Add both http and https versions of your App Engine URL to Vertex AI’s allowed domains list. Also check for trailing slash mismatches between what you added and your actual domain.

7

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.