OAuth callback URL not whitelisted: pre-release and first 30 minutes checklists

A new domain or route is not registered with the identity provider.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

7 pre-release items · 7 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Run the SAML login flow against a test identity provider registered with the redirect_uri an existing customer used before the change, and confirm login succeeds. e2e
PR-02For any change to the SSO init host or the callback path, compare the redirect_uri a test login sends before and after the change, and block the release if it differs. e2e
PR-03Run OAuth sign-in through every callback route the router defines, including the secondary-site route, and confirm the identity provider accepts each redirect URI. e2e
PR-04List the callback URLs the release generates and compare them with the redirect URIs in each identity provider app registration, matching scheme, host, path, casing and trailing slash. config
PR-05Before a portal moves to a custom domain or behind a CDN or gateway, confirm the new public host is registered as a redirect URI in the app registration and in the portal's redirect setting. config
PR-06Schedule a login probe for one newly configured custom domain and one default domain, and alert on any invalid redirect URI error. synthetic
PR-07Schedule a SAML SSO login probe for each supported init host, including the legacy SSO host. synthetic

First 30 minutes

FM-01Open an incident on the first customer report of a redirect URI error at login, without waiting for further reports to escalate.
FM-02Capture the exact identity provider error from a failing login, such as an invalid redirect URI or a redirect URI mismatch.
FM-03Compare the redirect_uri sent in a failing login with the one registered at the identity provider, including host, callback path and any customer id.
FM-04Find the recent change that touched the SSO init host, the callback path, the callback route definitions or custom domain setup.
FM-05Decide whether to revert the callback change or to turn off the new custom domain redirection temporarily as containment.
FM-06Tell affected customers whether they must update the redirect URI in their identity provider or recreate a custom domain, or whether they only need to wait for the fix.
FM-07Post a status update that names the affected login path, such as SAML SSO or login on custom domains.

Download the checklist

Pre-release checklist (Markdown)1.7 KB · v1.0.0
First 30 minutes checklist (Markdown)1.3 KB · v1.0.0

Only in this checklist

Every test class in this checklist also appears in at least one sibling checklist in the group; the item texts differ: Run the SAML login flow against a test identity provider registered with the redirect_uri an existing customer used before the change, and confirm login succeeds.

Questions

What should be checked before a release to prevent OAuth callback URL not whitelisted?

7 pre-release items, PR-01 to PR-07. PR-01: Run the SAML login flow against a test identity provider registered with the redirect_uri an existing customer used before the change, and confirm login succeeds.

Is there a rollback plan for OAuth callback URL not whitelisted?

The first-30-minutes checklist has 7 items. FM-01: Open an incident on the first customer report of a redirect URI error at login, without waiting for further reports to escalate.

What should a team do in the first 30 minutes after OAuth callback URL not whitelisted is detected?

The first-30-minutes checklist has 7 items. FM-01: Open an incident on the first customer report of a redirect URI error at login, without waiting for further reports to escalate.

Which configuration checks apply to OAuth callback URL not whitelisted?

PR-04: List the callback URLs the release generates and compare them with the redirect URIs in each identity provider app registration, matching scheme, host, path, casing and trailing slash. PR-05: Before a portal moves to a custom domain or behind a CDN or gateway, confirm the new public host is registered as a redirect URI in the app registration and in the portal's redirect setting.

Is a OAuth callback URL not whitelisted checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: end-to-end tests, configuration and environment tests and synthetic monitoring.

Which pipeline stages does the OAuth callback URL not whitelisted checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.