Redirects (titled Redirections on the page) sets where the hosted identity flows send people: "Configure success and error redirection URLs for your application."
The rail has three tabs: General, Auth Redirect, and Compliance.
General
"The public address used across your hosted identity flows."
One field, Website URI: "The URL of your application's website. Used across your hosted identity flows." It is fixed to https:// and saved with "Save website URI".
This is the address the hosted pages treat as your app's home, the link behind your logo, and the fallback destination when a flow completes without a more specific target.
Auth Redirect
The callback URLs for the OAuth and OIDC flows:
| Setting | Purpose |
|---|---|
| Redirect URI | Where the authorization server returns after a successful sign-in, with the code or tokens. |
| Post sign-out URI | Where users land after signing out. |
| Error URI | Where users land when a flow fails. |
Redirect URIs are validated against your verified domains, an unverified host is rejected, which is what stops an attacker from redirecting an authorization code to their own server.
Compliance
Legal and consent destinations shown on the hosted pages, your terms of service and privacy policy URLs, and any consent copy the flow needs to display.
Scope
Like the rest of the environment configuration, redirects are set per environment. A dev environment typically points at http://localhost:3000, while prod points at your live host, and the same code works in both because the SDK reads the environment's configuration rather than hardcoding a URL.
Related
| Read | To learn how to |
|---|---|
| Domains | Serve identity flows from your own hostname |
| Tenants | Verify the domains that redirect URIs are checked against |
| Authentication | Register OpenID clients and their grants |
| Branding | Style the pages users are redirected through |
| Deployments | Configure per-environment URLs across stages |