# OAuth callback URL not whitelisted: pre-release checklist

Source: https://releasefailures.com/incidents/oauth-callback-url-not-whitelisted/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A new domain or route is not registered with the identity provider.
- [ ] PR-01 Run the SAML login flow against a test identity provider registered with the redirect_uri an existing customer used before the change, and confirm login succeeds. (test class: End-to-end tests)
- [ ] PR-02 For any change to the SSO init host or the callback path, compare the redirect_uri a test login sends before and after the change, and block the release if it differs. (test class: End-to-end tests)
- [ ] PR-03 Run OAuth sign-in through every callback route the router defines, including the secondary-site route, and confirm the identity provider accepts each redirect URI. (test class: End-to-end tests)
- [ ] PR-04 List the callback URLs the release generates and compare them with the redirect URIs in each identity provider app registration, matching scheme, host, path, casing and trailing slash. (test class: Configuration and environment tests)
- [ ] PR-05 Before a portal moves to a custom domain or behind a CDN or gateway, confirm the new public host is registered as a redirect URI in the app registration and in the portal's redirect setting. (test class: Configuration and environment tests)
- [ ] PR-06 Schedule a login probe for one newly configured custom domain and one default domain, and alert on any invalid redirect URI error. (test class: Synthetic monitoring)
- [ ] PR-07 Schedule a SAML SSO login probe for each supported init host, including the legacy SSO host. (test class: Synthetic monitoring)