Release Incident Playbook

OAuth callback URL not whitelisted: symptoms, cause, and the test that catches it

A new domain or route is not registered with the identity provider.

OAuth callback URL not whitelisted is documented by 3 accepted public reports from 3 organisations, 2 of them published in the last 5 years.

  • Likelihood: low (2 public reports in 5 years)
  • Impact: medium (3 of 3 reports: availability)

3 public reports · verified 2026-10-21

Symptoms

User-visible

  • Customers could not log in to applications on a newly configured custom domain and saw an invalid redirect URI error.[1]
  • Customers could not log in through SAML SSO for about three days because of a redirect issue.[2]
  • OAuth sign-in to the secondary-site replication feature showed the error The redirect URI included is not valid.[3]

Monitoring-visible

  • Several customer reports of failed SAML SSO logins arrived and were escalated into an incident.[2]
  • Sign-in attempts after a portal moved to a custom domain or behind a gateway returned an identity provider error stating that the redirect URI does not match the redirect URIs configured for the application.[4]

Root causes

  1. stage: code A change to the SAML SSO init process moved the customer id from a GET parameter to a POST parameter, so the redirect_uri shrank to auth/callback/saml. The same change switched the init host from the legacy SSO host to the main application host, and both changes produced a redirect_uri that customers' identity providers did not expect.[2]
  2. stage: config A service change related to an ongoing platform migration broke login for applications on newly configured custom domains.[1]
  3. stage: code A refactor of the single sign-out feature defined a different callback URL from the one the routes used for OAuth in the secondary-site replication feature.[3]

Public examples

  1. [1]OutSystems, 2026-01-16. On 16 January 2026 a service change related to an ongoing migration left OutSystems customers unable to log in to applications on newly configured custom domains, which returned an invalid redirect URI error, until custom domain redirection was temporarily disabled and affected domains were recreated. primary Incident affecting login via custom domains
  2. [2]Phrase, 2024-02-06. A change to the Strings SAML SSO init process moved it from the legacy sso.phrase.com host to app.phrase.com and dropped the customer id from the callback path, so the redirect_uri no longer matched what customers' identity providers expected and customers could not log in via SAML for about three days. primary Unable to log in via Strings SSO login (redirect issue)
  3. [3]GitLab, 2016-06-07. A refactor of GitLab's Single Sign Out feature made GitLab Geo use a different OAuth callback URL from the one its routes used, so OAuth sign-in for Geo failed with the error that the redirect URI included is not valid. primary Geo: The redirect URI included is not valid. (OAuth)

Practitioner sources cited for symptoms

  1. [4]Work 365, 2025-11-03. A support article describes the AADSTS50011 redirect URI mismatch seen when a Power Pages portal moves to a custom domain or is fronted by a CDN or gateway without the new host being added as a Redirect URI in the Entra ID app registration and portal Site Settings. practitioner Self-Service Portal Sign-In Error: AADSTS50011

Test classes that catch it

Test classStageLimitationBasis
End-to-end testspre-deployA login test against the team's own identity provider setup or a freshly created test setup passed in the SAML case, so an end-to-end suite misses the mismatch unless it replays a redirect_uri that an existing customer registered before the change.by design analysis
Configuration and environment testspre-deployA configuration check reads only the product's own settings, so it cannot see the redirect URIs that each customer registered in their own identity provider.by design analysis
Synthetic monitoringpost-deployA scheduled login probe on the default domain stays green, because only applications on newly configured custom domains returned the invalid redirect URI error.by design analysis

Risk

  • Likelihood: low (2 public reports in 5 years)
  • Impact: medium (3 of 3 reports: availability)
Counts behind the grades
Accepted public reports3
Published in the last 5 years2
Impact stated: availability3

How the grades are computed

Pre-release checklist

  • PR-01
  • PR-02
  • PR-03
  • PR-04
  • PR-05
  • PR-06
  • PR-07

First 30 minutes

  • FM-01
  • FM-02
  • FM-03
  • FM-04
  • FM-05
  • FM-06
  • FM-07

Download the checklist

What catches this: catalogue entries

Listed because their own documentation or site names end-to-end tests, configuration and environment tests, synthetic monitoring on the verification date. Alphabetical. Not a recommendation.

Tools whose documentation names these test classes

Providers whose site names these test classes

Only on this page

OAuth callback URL not whitelisted has a reported time to detect of 4285 minutes in report [2], about three days. The change to the SAML SSO init process shipped on February 2nd. The incident was logged on February 5th after several customer reports were escalated [2]. Tests with the company's own identity provider setup and with a new test identity provider setup passed before the release [2].

The failing redirect URIs sat in registrations that the vendor did not own. Customers' identity providers still expected the earlier redirect_uri, which carried the customer id in the path and used the legacy SSO host [2]. The fix shipped on February 5th at 11:48 AM CEST, and the follow-up named SSO host handling for SAML init [2].

Questions

What causes OAuth callback URL not whitelisted?

Two reports trace it to code that changed the callback: a new SAML init host and callback path [2] and a single sign-out refactor that defined a different callback URL [3]. Report [1] traces it to a service change during a platform migration that broke custom domain login.

What are the symptoms of OAuth callback URL not whitelisted?

Users saw an invalid redirect URI error on login [1][3]. In report [2], several customer reports of failed SAML SSO logins were escalated into an incident.

Why did tests not catch OAuth callback URL not whitelisted?

In report [2], tests with the company's own identity provider setup and a new test setup passed. Customers' identity providers still expected the earlier redirect_uri [2].

Which public reports document OAuth callback URL not whitelisted?

Three primary reports from three organisations document it, published between 2016-06-07 [3] and 2026-01-16 [1]. All three classify the impact as availability.

How long did it take to detect OAuth callback URL not whitelisted in the public reports?

Report [2] records 4285 minutes, from a change on February 2nd to an incident logged on February 5th. The other two primary reports state no time to detect.

Should a team roll back or fix forward when OAuth callback URL not whitelisted happens?

Report [2] fixed forward on February 5th. Report [1] turned off custom domain redirection temporarily and told remaining customers to recreate their custom domain. FM-05 covers this decision.

Release Incident Playbook (2026). OAuth callback URL not whitelisted: symptoms, cause, and the test that catches it, content version 1.0.0. https://releasefailures.com/incidents/oauth-callback-url-not-whitelisted/. Accessed 2026-10-21.