OAuth redirect-URI rules.

Required shape

Each redirect URI on a Citadel-registered OAuth client must be:

• Absolute. Relative URIs are rejected.
• HTTPS, or http://localhost and http://127.0.0.1 for development. Plain HTTP on any other host is rejected.
• No fragment (#…). Fragments are stripped by browsers before the redirect; OAuth flows can't carry them safely.
• No query string on the registered URI itself. The OAuth flow appends its own ?code=…; mixing pre-set query params with the OAuth response confuses many client libraries.

How matching works

At authorization time the client supplies a redirect_uri parameter; Citadel performs an exact-match against the registered list. Trailing slashes count, port numbers count, scheme-case counts. Add every variant your application uses to the list (development + staging + production).

Required for confidential clients

If your client is registered as confidential (server-side, holds a secret), at least one redirect URI is required. E-redirect_uris_required fires when the create form's redirect-URI list is empty.

Public clients (PKCE-only) may register with no redirect URIs in v1, but most apps will want them — they're the only way Citadel knows where to send the user back.

What to try

• Replace http://your-domain.com/cb with https://your-domain.com/cb.
• Strip any #fragment or ?param=value from the registered URI.
• For local development, use http://localhost:5173/auth/callback (or whatever port your dev server uses).
• If the URI looks valid to you but the form rejects it, try copying it character-by-character — invisible Unicode whitespace in copied URLs is a common culprit.