Redirect URI mismatch checker
Paste the redirect URI you registered and the one your client actually sent. This tool names the difference — trailing slash, port, host case, encoding, or an invisible character you cannot see. Everything runs in your browser.
The value configured on your OAuth client.
Copy this from the actual authorization request, not from your source code.
Enter both values to see a diagnosis. Nothing is sent anywhere — the comparison runs entirely in your browser.
Why exact matching is the rule
The redirect URI is where an authorization code is delivered. If an attacker can make a server accept a URI it should not, the code goes to them instead of your application. Prefix and wildcard matching have both produced real vulnerabilities, so OAuth 2.1 and RFC 9700 settled on comparing the full string.
The practical consequence is that the redirect URI is configuration, not something to build dynamically. Keep one canonical value per environment, and never append per-request data to it — state exists for that.
Common causes
- Why do I get redirect_uri_mismatch or invalid_request?
- The authorization server compares the redirect_uri on the request against the registered value as an exact string. Any difference in scheme, host case, port, path, trailing slash, query string or encoding is a mismatch, even when both URIs resolve to the same page in a browser.
- Can I register a wildcard redirect URI?
- No. OAuth 2.1 and RFC 9700 require exact string matching precisely because pattern matching has produced real open-redirect and token-theft vulnerabilities. A wildcard is compared literally and will never match.
- Does the default port matter?
- Yes. https://app.example.in:443/callback and https://app.example.in/callback are different strings. Register the form without the default port and make the client send that form.
- Why does it work locally but not in production?
- Usually a different registered client per environment, or localhost registered while the browser opens 127.0.0.1. Those two hostnames are not interchangeable under exact matching.