Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Redirect URIs and start URL

Where a sign-in returns to, and where the sign-in surface sends users who arrive without one.

Redirect URIs

After signing in, frontend users return to one of the frontend's "Redirect URIs" with the authorization code. A frontend has 1 to 10, entered on the "Sign-in" card ("Add redirect URI" adds one). The rules:

  • Scheme: https:// with a host name, or http only on localhost or 127.0.0.1 (any port) for local development.
  • Exact: the frontend must send the address character for character as it is entered in the Studio. No wildcards.
  • Characters: no fragment (#), no *, no commas and no spaces; % only as a %XX escape.
  • Each redirect URI only once.

The redirect_uri of your authorize request must be one of them exactly, and the token request must repeat the same one. A request with an unregistered redirect URI never comes back to you: it ends on a neutral error page on the sign-in surface.

Pannoniqa's portal, for example, registers https://portal.pannoniqa.example/auth/callback for production and http://localhost:3000/auth/callback for development.

Start URL

The "Start URL" is the page of your frontend where the sign-in surface sends a frontend user who arrives without a sign-in started by your frontend:

  • after a password reset;
  • after the sign-out page;
  • when an expired sign-in request cannot be restarted.

Its origin (scheme, host and port) must match one of the redirect URIs, and it follows the same scheme and character rules. Make it a page that works for a signed-out visitor and offers "Log in", or starts the sign-in itself: for Pannoniqa, https://portal.pannoniqa.example/.

Changing them

A change takes effect when the Studio user clicks "Save sign-in settings". Your client ID and secret stay the same. Deploy a new callback before you remove the old redirect URI, or sign-ins in progress fail.