Start here · Step 2

Configure redirect URIs

Register every callback exactly so UnifyID can return authorization responses only to destinations controlled by your application.

Register the callback

Add the complete callback URI, including scheme, host, port, and path. Query strings are part of the registered value; URL fragments and wildcards are not accepted.

Sandbox web callback
http://localhost:3999/oauth/callback

Production web callback
https://app.example.com/oauth/callback

Exact matching

The redirect_uri sent during authorization and token exchange must exactly match a registered URI. Differences in scheme, port, path, trailing slash, or letter case are rejected.

Security requirements

Use HTTPS outside local development.
Do not register open redirect endpoints.
Keep callbacks narrow and dedicated to OAuth completion.
Validate state before displaying or processing returned data.