Reference

Callback URL rules

Identise sends a browser, and a sign-in token, only to an address your app registered.

What you can register

Callback URLs and the homepage URL must be:

absolute https:// URLs; http:// is allowed only for localhost, 127.0.0.1 and [::1];
without user info (https://user@host), a fragment (#…), wildcards (*), spaces, backslashes, or an encoded / or \ in the path;
at most 2048 characters each, and at most 20 per app.

What's allowed at sign-in

The address asked for at sign-in is allowed if it is either:

a registered callback: the same scheme, host, port and exact (case-sensitive) path. You may add your own query parameters, unless the registered URL has a query, which must then match exactly; or
any path under your homepage: https://www.yourapp.com/shop allows /shop and /shop/…, not /shopping.

A relative URL is added to the homepage: with the homepage https://www.yourapp.com/shop, /thanks means https://www.yourapp.com/shop/thanks. Anything else answers 400 Application.InvalidUrl, and nobody is redirected.

Examples

Registered: https://www.yourapp.com/auth/callback, homepage https://www.yourapp.com/shop.

Asked for	Allowed?
`https://www.yourapp.com/auth/callback?next=/billing`	Yes: a registered callback with your own query.
`https://www.yourapp.com/shop/orders`	Yes: under the homepage.
`/thanks`	Yes: https://www.yourapp.com/shop/thanks, under the homepage.
`https://www.yourapp.com/Auth/Callback`	No: paths are case-sensitive.
`https://www.yourapp.com/shopping`	No: not under /shop.
`http://www.yourapp.com/auth/callback`	No: http only for localhost.
`https://evil.example/auth/callback`	No: another host.

Register only the exact callbacks you use, all https:// in production. A connection token sent to the wrong place can be exchanged by whoever receives it within 5 minutes.