OAuth2 "redirect_uri_mismatch" in CI end-to-end auth tests

By Daniel Zoghalchali·Latchkey

The OAuth2 authorization server rejected the request because the redirect_uri does not exactly match one registered for the client. Matching is exact: scheme, host, port, and path must all agree.

What this error means

An end-to-end login test fails at the authorize step with "error":"redirect_uri_mismatch". It commonly appears when CI runs the app on a different host or port than the registered callback.

HTTP/1.1 400 Bad Request

{"error":"redirect_uri_mismatch","error_description":"The redirect URI in the request, http://localhost:3001/callback, did not match a registered redirect URI"}

Common causes

CI runs the app on a different port or host

Locally the callback is http://localhost:3000/callback but CI binds :3001 or a container hostname, so the exact match fails.

A trailing slash or scheme difference

http vs https, or /callback vs /callback/, counts as a mismatch because comparison is byte-exact.

How to fix it

Register the exact CI callback URI

1. Add the precise redirect_uri the CI app uses to the client allow-list.
2. Pin the port the app binds in CI so the URI is stable.
3. Match scheme, host, port, and path exactly, including any trailing slash.

env:
  PORT: '3000'
  OAUTH_REDIRECT_URI: http://localhost:3000/callback

Use a dedicated CI client

Register a separate client whose only allowed redirect URIs are the CI callbacks, so test URIs do not pollute production.

How to prevent it

• Pin the port and host the CI app binds so the callback is deterministic.
• Register the exact CI redirect URIs on a dedicated test client.
• Avoid dynamic ports for OAuth end-to-end tests.

Frequently asked questions

Related guides

References

• GitHub Actions documentation