OAuth redirect_uri mismatch
Fix 400 redirect_uri does not match any registered URI when signing in to the Web UI.
Sign-in failing with:
400 redirect_uri does not match any registered URI…means the origin trying to complete the OAuth flow isn't registered as a
server web_redirect_uri. This almost always involves the optional
Web UI, which runs on its own origin.
The fix
Register the UI origin's callback as a server redirect URI:
In .env:
EDDYTOR__SERVER__WEB_REDIRECT_URIS=http://localhost:3000/auth/callbackThen docker compose up -d. Beyond localhost, set it to
${EDDYTOR_UI_ORIGIN}/auth/callback.
The chart derives this from ui.origin automatically:
helm upgrade eddytor … --reuse-values \
--set ui.enabled=true --set ui.origin=https://app.eddytor.example.comIt registers {ui.origin}/auth/callback as a server redirect URI.
Heads up
The env form REPLACES (not merges with) any
web_redirect_uris in config.toml. To allow several origins, put them all on
that one env line, comma-separated.Common specifics
- The origin must exactly match what the browser hits - scheme, host, and
port (
http://localhost:3000, not127.0.0.1:3000). config.publicUrl/ui.originmust equal the real browser address, or cookies and redirects break - this is why the raw-LoadBalancer path is a two-step.
SSO variant
For an OIDC sign-in connection, the IdP's redirect URI must be
${server.public_url}/v1/oauth/sso/callback (or
${oauth_redirect_base}/… if you set that override). See
SSO with OIDC.