Error 400: redirect_uri_mismatch means the OAuth authorization request sent a redirect_uri that is not registered for the OAuth client identified by its client_id. Capture the complete URI emitted by the running application, decode it once for inspection, and compare it character by character with the callback registered for that same client. Differences in scheme, host, port, path, case, trailing slash, query string, or even the selected client can cause rejection.
What the message says
The message contains three separate clues. Reading them individually prevents the most common misdiagnosis: treating the number 400 as a general server outage.
As an Amazon Associate I earn from qualifying purchases.
Error 400
HTTP status 400 means the authorization server rejected the request during validation. It does not identify which character is wrong, prove that the provider is unavailable, or tell you whether the application or console contains the incorrect value. The useful evidence is the request that reached the provider.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →redirect_uri
OAuth uses redirect_uri to name the callback endpoint where the authorization server returns the browser after the user approves (or denies) access. In an authorization-code flow, the authorization response arrives at that endpoint and the application exchanges the returned code for tokens.
#1 Best Overall
mismatch
The value in the request does not match an authorized redirect URI associated with the supplied client_id. Google uses this explicit error name for that condition. A callback registered under another project, environment, or client type cannot satisfy the request even when the text of the URI itself looks correct.
Read the URI character by character
For a complete registered redirect URI, OAuth 2.0 specifies simple string comparison. Google describes the requirement as an exact match, and Microsoft Entra documents the same requirement for its authorization-code flow. Do not assume that a browser, framework, or provider will normalize differences for you.
| Part to inspect | Request example | Registered example | Why it fails |
|---|---|---|---|
| Scheme | http:// |
https:// |
HTTP and HTTPS are different strings. Production callbacks normally need HTTPS; localhost is an exception in Google’s documented rules. |
| Hostname | localhost |
127.0.0.1 |
Both can point to your own computer, but they are not the same host name. |
| Subdomain | app.example.com |
www.example.com |
A different host requires its own registration. |
| Port | :3000 |
:443 |
Ports are part of the URI. A reverse proxy can hide the public port while the application still emits an internal one. |
| Path | /oauth/callback |
/oauth/call-back |
Spelling, hyphens, underscores, and every path segment matter. |
| Case | /OAuth/Callback |
/oauth/callback |
Do not rely on case folding. Compare the complete strings exactly. |
| Trailing slash | /callback/ |
/callback |
A final slash changes the URI. |
| Query component | ?tenant=blue |
no query | Adding or removing a query component changes the registered value. Whether a provider permits a particular form is provider-specific. |
| Encoding | redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback |
https://app.example.com/callback |
The parameter is URL-encoded in the outer request. Decode it once to compare the URI, but preserve the original request when diagnosing what was sent. |
A URI fragment, such as #section, is not sent to a server by a normal browser request and is generally unsuitable for an OAuth callback. Follow the matching provider’s documented URI rules instead of adding a fragment as a workaround.
Free tools Windows power users keep installed
One-click scans. No signup required.
A reliable diagnostic sequence
Work from the running request toward the registration. Checking only what someone remembers entering in a console often misses an environment variable, framework default, or proxy rewrite.
- Capture the complete authorization request. Use the browser’s address bar, network panel, server log, or an OAuth library’s debug output. Locate the full
redirect_uriparameter and theclient_idin the same request. Do not compare a callback copied from a different login attempt. - Decode the parameter once. An outer URL commonly contains values such as
https%3A%2F%2Fapp.example.com%2Foauth%2Fcallback. Decode that parameter to obtainhttps://app.example.com/oauth/callbackfor visual comparison. Repeated decoding can turn a literal percent sequence into a different character, so do it only once. - Verify the client ID and project. Open the provider console for the project, application, environment, and OAuth client represented by that exact
client_id. A development client and a production client can have identical-looking settings but separate registration lists. - Compare every component. Check scheme, hostname, subdomain, port, path spelling and case, trailing slash, query component, and any provider-specific restrictions. Treat an apparent cosmetic difference as a real mismatch until the provider’s documentation says otherwise.
- Inspect callback construction. Find the setting or code that creates the URI. Common inputs include an environment variable, framework base-URL setting, deployment domain, router prefix, or forwarded-proto header. Log the final value immediately before constructing the authorization URL; logging only a base domain can hide a wrong path or port.
- Account for the reverse proxy. A proxy may expose
https://login.example.comwhile the application believes it is servinghttp://127.0.0.1:8080. Configure trusted proxy headers and the public origin, or set the callback explicitly, so the emitted value is the externally registered URI. - Fix one side deliberately. Either change the application to send an already authorized callback or add the intended, controlled callback to the correct OAuth client. Do not register an arbitrary destination merely to make the error disappear.
- Retry with a fresh request. Clear a cached authorization URL, restart the process after changing environment variables, and confirm that the new request contains the corrected value. If the authorization-code flow continues to the token endpoint, use the identical
redirect_urithere as well.
Provider-specific rules you must not mix
Google’s web-server OAuth documentation ties each authorized redirect URI to the supplied client ID and names a mismatch as redirect_uri_mismatch. Google’s Cloud Console validation rules include HTTPS for non-localhost callbacks, while localhost callbacks are permitted for development. The rules also prohibit userinfo in the authority (for example, embedding a username and password) and path traversal. Additional URI restrictions can change, so check the current rules for the client type before editing a registration.
Google’s localhost exception does not make every local form interchangeable: http://localhost:8080/callback, http://127.0.0.1:8080/callback, and http://localhost:3000/callback remain different strings. Register the exact host, port, and path your local process emits.
Microsoft Entra
Microsoft Entra reports a comparable condition as AADSTS50011. Its authorization-code guidance requires the request’s redirect_uri to exactly match a registered value, and the value is URL-encoded inside the authorization request. Entra also distinguishes single-page application redirect configuration: a SPA needs the appropriate spa platform type and corresponding cross-origin setup. Those conditions should not be copied into a Google configuration, and Google’s error label should not be expected from Entra.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchEnvironment differences that create valid-looking mistakes
Local development versus deployment
It is normal to have separate callbacks for local, staging, and production, but each must be explicitly supported by the selected client and provider. A production build that accidentally retains http://localhost:3000/callback will fail for deployed users; a local build that derives its URL from the production domain can fail on a developer machine. Keep environment-specific values in clearly named configuration and print the resolved callback during startup or a safe debug request.
Rank #3
Web app versus SPA or native client
Providers classify OAuth clients differently. A server-rendered web application usually owns a confidential client and handles the callback on its server. A browser-only SPA uses a public client and provider-specific browser settings. Native applications may use loopback or claimed-app links according to the provider’s rules. Selecting the wrong client type can leave the URI text correct but the registration context invalid.
Framework and router prefixes
Mounting an application under /account can turn an intended /oauth/callback route into /account/oauth/callback. Likewise, a framework may append a slash, normalize a path, or derive a host from an internal request. Confirm both the route that actually receives the callback and the string used to construct the authorization request.
Common failure patterns and targeted fixes
“Everything looks the same”
Paste the decoded request value and the registered value into a tool that reveals whitespace and punctuation, or compare their character codes in a local script. Look for a final slash, a different dash character, an uppercase path letter, or an invisible space copied from configuration. Do not rely on visual inspection alone.
Recommended Free Tools
Wrong client after a credential rotation
Replacing a client secret or environment file can also switch the client ID. Open the authorization URL and verify the ID, then inspect that exact client in the provider console. Registration under an old client does not transfer automatically.
Proxy changes HTTPS to HTTP
If users reach the site over HTTPS but the callback contains HTTP, configure the application to trust the proxy’s forwarded protocol only when the proxy is controlled and correctly set. Alternatively, set a fixed public callback URL. Never solve this by allowing an untrusted host to supply the callback.
Query parameters added for state
OAuth’s state value belongs in the authorization request and should be validated when the callback returns; it does not require inventing a different registered callback for every state value. If an application appends a tenant or session query parameter to redirect_uri, the resulting URI may no longer match a registration. Prefer a stable callback and carry state separately, subject to the provider’s documented rules.
Encoded value compared literally
The outer authorization URL must encode the redirect_uri parameter so its slashes and query delimiters are not mistaken for delimiters in the outer URL. The provider compares the decoded parameter value with the registered URI. Encode once when constructing the request and decode once when inspecting it; double encoding or double decoding changes the value.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhy strict matching is a security control
Registration prevents an authorization response from being sent to a destination controlled by someone else. OAuth 2.0 says that when validation fails because a redirection URI is missing, invalid, or mismatching, the authorization server must not automatically redirect the user agent to that invalid URI. Without registration, an attacker could abuse an open redirector to capture codes or authorization responses.
The same protection continues at the token endpoint. In an authorization-code exchange, the redirect_uri supplied with the token request must be identical to the one used in the authorization request when the client included it initially. Correcting only the first request can therefore expose a second, different failure.
Quick Recap
- Register only endpoints your application controls.
- Use specific paths rather than broad wildcard destinations when the provider permits multiple entries.
- Do not disable redirect validation.
- Do not use an attacker-controlled host, open redirector, or temporary public URL as a shortcut.
- Keep development callbacks separate from production credentials and registration.
Final verification checklist
- The captured request contains the expected
client_idfor the intended project and environment. - The
redirect_urihas been decoded once and copied exactly, including scheme, host, port, path, case, slash, and query component. - The same value appears in the authorized redirect list for that exact client.
- The URI complies with the selected provider and client type, including HTTPS, localhost, SPA, or native-app rules where applicable.
- Reverse-proxy and framework settings produce the public callback rather than an internal address.
- The token exchange, if present, sends the same redirect URI as the authorization request.
- No wildcard, untrusted destination, or validation bypass was introduced.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
