OAuth redirect URI / callback URL
The exact, pre-registered URL where an OAuth provider sends the browser after the person approves or cancels access.
What it is
The redirect URI is the route an OAuth provider sends the browser to after approval or denial. It is also called the callback URL. The authorization response arrives there with a short-lived `code` and the `state` value your app sent, or with an error when the person cancels.
Register every allowed URI in the provider's console, then send one of those exact values as `redirect_uri` in both the authorization request and code exchange. Keep separate HTTPS callbacks for production and staging, with a localhost callback registered explicitly for local development.
The gotcha is exact matching. A different scheme, host, port, path, case, or trailing slash can produce Google's familiar `Error 400: redirect_uri_mismatch` screen. Never accept a callback destination from an arbitrary query parameter or register a broad wildcard, since an attacker who controls the destination can steal the authorization response.
Ask AI for it
Add Google OAuth 2.0 Authorization Code with PKCE using `https://accounts.google.com/o/oauth2/v2/auth` and `https://oauth2.googleapis.com/token`. Register `https://app.example.com/auth/google/callback` as an authorized redirect URI in Google Cloud Console and use that exact string as `redirect_uri` in both requests. At the callback, verify the stored `state` before handling `code`, exchange the code with its PKCE verifier on the server, and show a normal cancelled-login screen for `error=access_denied`. Configure separate exact callback URLs for staging and localhost; do not accept a caller-supplied callback URL or use wildcard redirects.