Core concepts

Redirect URIs

The callback is a security boundary, not a loose return URL.

Exact registration

Register each complete callback URI in the Developer Portal. Scheme, host, port, path, and trailing slash matter. Do not assume wildcard or arbitrary subdomain matching. A localhost callback works only when that exact URI is registered; use HTTPS in production.

Conceptual exact-match examples

Registered: https://example.com/auth/callback
Matches:    https://example.com/auth/callback
Does not:  http://example.com/auth/callback
Does not:  https://example.com/auth/callback/
Does not:  https://other.example.com/auth/callback

Callback handling

Compare the received state against the one stored for that browser transaction before exchanging a code. Reject a missing or mismatched state. Do not put credentials, tokens, or a client secret in the redirect URI. Avoid logging callback codes.