⌘ K
OpenAPI

BUILD

Redirect URIs

Redirect URI validation is exact and intentionally narrow.

Accepted

  • HTTPS URLs with no fragment, username, or password.
  • HTTP only for localhost or 127.0.0.1 local development when explicitly registered.

Rejected

  • Unregistered values.
  • Fragments, embedded credentials, and non-HTTPS public origins.
  • Wildcard or silently normalized redirect targets.