Configuring OpenID Connect (OIDC) Sign-in Redirect URIs in Okta securely routes users after authentication. The value of the redirect_uri parameter in the /authorize request must exactly match one of the allowed Sign-in Redirect URIs in the application settings to prevent authentication failures. A mismatch between the requested URI and the configured URI generates the following error:

Okta Error "400 Bad Request" - "The redirect_uri Parameter Must Be a Login Redirect URI in the Client App Settings"

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• Sign-in Redirect URI
• Authorize (GET /authorize) request of Implicit Flow and Authorization Code Flow

What is the purpose of the redirect URI?

The application initiates the flow by building the /authorize request. This request includes the redirect_uri parameter, which tells Okta exactly where to securely return the user after successful authentication.
Review the following example of an /authorize request that uses https://example.com as the redirect URI.

Configure the sign-in redirect URIs in the Okta Admin Console.

Navigate to the application settings in the Okta Admin Console, locate the login configuration, and add the required URI to the sign-in redirect URIs field as detailed in either the video demonstration or the written instructions.

1. Navigate to Applications > Applications.
2. Select the application and navigate to the General tab.
3. Locate the LOGIN section.
4. Add the URI to the Sign-in redirect URIs field.
   
   

What are common mistakes with redirect URIs?

The redirect_uri that the application sends to Okta as part of the /authorize request must exactly match one of the Sign-in redirect URIs that the application allows. Note that "Sign-out redirect URIs" are configured separately and serve a different purpose from "Sign-in redirect URIs."

If Okta generates a “400 Bad Request” - The redirect_uri Parameter Must Be a Login Redirect URI in the Client App Settings error during the /authorize request, verify that the redirect_uri being sent by the application matches what is configured for the application based on the following criteria:

• HTTP vs HTTPS
• Subdomain/domain
• Trailing slash
• Case sensitivity
• Port number
• Dynamic query parameters
• Request path
• URL encoding

Related Resources

• Okta Error "400 Bad Request" - "The redirect_uri Parameter Must Be a Login Redirect URI in the Client App Settings" | Okta Support Center
• Request an authorization code | Okta Developer
• /authorize | Okta Developer
• How To Create an OIDC Web App in the Okta Admin Console | Okta Support Center
• How To Create an OIDC SPA App in Okta Admin Console | Okta Support Center