Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Error 400: redirect_uri_mismatch means the OAuth provider rejected an authorization request because the callback URL sent by your application does not exactly match an authorized redirect URI for the OAuth client identified by client_id. The reliable fix is to capture the URI the running application actually sends, compare it character by character with the registration for that same client, and correct the application or provider configuration.
What each part of the error means
The message is short, but each token points to a different part of the failed OAuth validation. Reading it precisely prevents you from chasing the wrong problem.
Error 400
HTTP status 400 means the authorization request was rejected as invalid. It does not prove that the provider is down, that your server crashed, or that one particular character is definitely wrong. The number only tells you that validation failed before authorization could continue.
redirect_uri
This is the callback endpoint where the authorization server returns the user after consent. In an authorization-code flow, the authorization response is delivered there. The application includes the value as a request parameter, normally alongside client_id, response_type, scope, and a state value.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
mismatch
The supplied callback does not match a redirect URI registered for that OAuth client. Google uses the explicit error name redirect_uri_mismatch. Microsoft Entra documents the comparable condition as AADSTS50011, so the label varies even though the configuration problem is similar.
Why “character by character” is the right troubleshooting method
For a complete registered redirect URI, OAuth 2.0 calls for simple string comparison. Google says the value must exactly match an authorized URI, and Microsoft Entra likewise requires an exact match while noting that the request value is URL-encoded. A browser may display a decoded URL while the provider compares the value represented in the request, so inspect both forms.
Do not assume that a provider will normalize differences for you. A changed scheme, host, port, path, slash, case, or query component can produce a different string. The exact set of accepted URI forms and restrictions remains provider- and client-type-specific.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Message part | What it identifies | What to inspect |
|---|---|---|
400 |
Authorization request failed validation | The complete request and the provider’s returned error details |
redirect_uri |
Callback endpoint supplied by the application | The exact parameter emitted by the running build |
mismatch |
Supplied URI is not registered for this client | The matching registration under the same client_id |
Character-by-character diagnostic procedure
Use this sequence in order. It separates an incorrect value from an incorrect client, and it catches deployment changes that are invisible in local configuration files.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
1. Capture the complete authorization request
Open the failing sign-in flow and copy the authorization request from the browser’s address bar, network inspector, or server log. Preserve the original encoded request. Then decode the redirect_uri parameter once for human comparison. Do not repeatedly decode it, because percent-encoded characters can be changed or misread during manual editing.
Record at least these values:
- The full
redirect_uriparameter, both encoded and decoded. - The
client_idused in the same request. - The provider authorization endpoint and the environment that generated the request.
- The redirect URI that your team believes is registered.
2. Verify the OAuth client before comparing URLs
A perfectly written callback still fails if it is registered under another client. Confirm that the client_id belongs to the intended provider project, application, environment, and client type. Development, staging, and production commonly use separate clients. A callback registered for one of them cannot satisfy a request made with another.
Check for copied credentials, an outdated environment variable, a different cloud project, or a framework profile that selects another client at runtime. Compare the client identifier in the actual request rather than relying on the value in a local configuration file.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Compare every URI component
Place the decoded request value and the registered value on separate lines, or compare them in a tool that reveals invisible characters. Work from left to right:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Scheme:
httpandhttpsare different. Google permits HTTP for localhost but requires HTTPS for other hosts under its documented URI rules. - Hostname:
localhost,127.0.0.1, and a machine name are different hosts. Check spelling, subdomains, and unexpected production domains. - Port:
:3000,:8080, and no explicit port are distinct values. - Path: Compare every segment, hyphen, underscore, and letter. Path case can matter, so treat
/OAuth/callbackand/oauth/callbackas different until the provider says otherwise. - Trailing slash:
/callbackand/callback/are not interchangeable under exact string matching. - Query component: A query string changes the URI. Check parameter names, order, encoding, and whether the application adds a query value at runtime.
- Fragment: Fragments are handled by the user agent and are generally unsuitable for an authorization-server callback. Do not add one as a workaround.
- Encoding: Compare the decoded semantic value, but retain the original encoded request when diagnosing what the server received.
4. Inspect how the callback is constructed
Most mismatches are introduced before the provider sees the request. Find the code or configuration that builds the callback and identify every input:
- Environment variables such as public origin, host, port, or base path.
- Framework settings for the application URL or OAuth callback route.
- Reverse-proxy headers such as the external scheme and host.
- Deployment-specific route prefixes, such as
/appor/portal. - Conditional logic that chooses a local, staging, or production URI.
A proxy can terminate HTTPS and forward HTTP internally. If the application trusts the internal scheme instead of the externally visible one, it may emit an http callback even though users access the site through https. Likewise, a proxy that adds or removes a path prefix can make the generated route differ from the registered route.
5. Correct one side deliberately, then retry
Choose the intended canonical callback. Either change the application so it emits that value or add the exact, controlled endpoint to the OAuth client’s authorized redirect list. Save the provider configuration, restart or redeploy anything that caches environment values, and start a fresh authorization request.
Do not register an arbitrary destination simply to make the error disappear. The endpoint must be one your application controls and one that is appropriate for the provider and client type.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Provider-specific rules you must keep separate
The matching principle is shared, but provider restrictions and error labels are not interchangeable.
| Provider or flow | Documented behavior | Practical implication |
|---|---|---|
| Google web-server OAuth | A mismatch between the request URI and an authorized URI for the supplied client ID produces redirect_uri_mismatch. Google documents HTTPS for non-localhost URIs and restrictions including disallowed userinfo and path traversal. |
Check the selected Google Cloud project and OAuth client, then verify scheme, host, path, and provider URI restrictions. |
| Microsoft Entra authorization-code flow | The request redirect_uri must exactly match a registered value and is URL-encoded in the request. The comparable error is AADSTS50011. |
Compare the encoded request with the Entra app registration and use the redirect-platform type intended for the application. |
| Microsoft Entra single-page application | SPA redirects use special application registration settings, including the appropriate spa type and CORS configuration. |
Do not apply SPA requirements to a server web client, or treat a server callback as a browser-origin callback. |
Provider documentation can change its accepted URI forms, so check the current rules for the exact provider and client type before editing a registration. A rule documented for Entra is not automatically a Google rule, and vice versa.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common environment-specific causes
Local development
Local callbacks often differ by host or port. A registration for http://localhost:3000/callback will not match http://127.0.0.1:3000/callback or http://localhost:5173/callback. Register the specific local endpoint you use, or make the development server consistently emit one canonical value.
Staging and production
A deployment may inherit a staging origin from an environment variable or may still use a development client ID. Verify the runtime values in the deployed process, not just the repository’s example configuration. If both environments are legitimate, give each its own controlled callback and OAuth client where the provider permits it.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Reverse proxies and ingress
Inspect the externally visible URL after load balancing, TLS termination, and path rewriting. The application must construct the callback from the public scheme, host, port, and path that the user will actually reach. Configure trusted proxy handling according to your framework rather than blindly trusting client-supplied forwarding headers.
Single-page applications and native clients
Browser-based SPA registrations and native-client registrations can have different platform rules from server web applications. Select the provider’s client type that matches the architecture. A callback that is valid for a server endpoint may not be valid as a SPA redirect, and a desktop loopback callback should not be copied into a public web deployment without checking the provider’s rules.
What not to do
- Do not disable redirect-URI validation.
- Do not use a wildcard callback unless the provider explicitly supports a narrowly defined pattern for that client type and you understand its security implications.
- Do not register a URL controlled by another party, a temporary paste service, or an attacker-controlled domain.
- Do not “fix” the issue by removing
redirect_uriwhen the flow or provider requires it. - Do not assume that adding a trailing slash, changing the case, or URL-decoding the value will be harmless.
RFC 6749 requires the authorization server not to redirect the user agent automatically when the redirect URI is missing, invalid, or mismatching. The standard highlights that failing to require registration can enable an open redirector. Strict matching is therefore a security control, not needless bureaucracy.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteExamples of small differences that cause the error
| Application sends | Registration contains | Difference |
|---|---|---|
https://example.com/oauth/callback |
http://example.com/oauth/callback |
Scheme |
https://example.com/oauth/callback |
https://www.example.com/oauth/callback |
Hostname |
http://localhost:3000/callback |
http://localhost:8080/callback |
Port |
https://example.com/callback/ |
https://example.com/callback |
Trailing slash |
https://example.com/OAuth/callback |
https://example.com/oauth/callback |
Path spelling and case |
https://example.com/callback?tenant=blue |
https://example.com/callback |
Query component |
These examples illustrate why visual inspection can fail: the URLs look nearly identical, but exact comparison treats each pair as different.
Check the token exchange after authorization succeeds
Fixing the authorization request may expose a second mismatch during the authorization-code exchange. RFC 6749 requires the redirect_uri sent to the token endpoint to be identical to the value used in the authorization request when it was included there. Store the canonical value once and reuse it for both requests instead of reconstructing it independently.
If the browser now returns to your callback but the token request fails, capture the token request separately. Confirm that the same client, code, and redirect URI are being used, with no change introduced by a different environment variable or URL encoder.
A concise recovery checklist
- Capture the failing authorization URL.
- Decode
redirect_urionce and preserve the original encoded value. - Confirm the request’s
client_idand provider project. - Open the registration for that exact client and copy the intended callback.
- Compare scheme, hostname, port, path, case, slash, query, and encoding.
- Inspect framework, environment, proxy, and deployment settings that construct the callback.
- Change the application or registration to the same controlled URI.
- Retry with a fresh authorization request, then verify the token exchange uses the identical value.
When the values truly match and the client type is correct, the redirect-URI validation error should no longer be the blocker. If it persists, capture a new request rather than comparing against an older browser URL or a remembered configuration value.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
