Redirects — titled Redirections on the page — sets where the hosted identity flows send people: "Configure success and error redirection URLs for your application."
The rail has three tabs: General, Auth Redirect, and Compliance.
General
"The public address used across your hosted identity flows."
One field, Website URI: "The URL of your application's website. Used across your hosted identity flows." It is fixed to https:// and saved with "Save website URI".
This is the address the hosted pages treat as your app's home — the link behind your logo, and the fallback destination when a flow completes without a more specific target.
Auth Redirect
The callback URLs for the OAuth and OIDC flows:
| Setting | Purpose |
|---|---|
| Redirect URI | Where the authorization server returns after a successful sign-in, with the code or tokens. |
| Post sign-out URI | Where users land after signing out. |
| Error URI | Where users land when a flow fails. |
Redirect URIs are validated against your verified domains — an unverified host is rejected, which is what stops an attacker from redirecting an authorization code to their own server.
Compliance
Legal and consent destinations shown on the hosted pages — your terms of service and privacy policy URLs, and any consent copy the flow needs to display.
Scope
Like the rest of the environment configuration, redirects are set per environment. A dev environment typically points at http://localhost:3000, while prod points at your live host, and the same code works in both because the SDK reads the environment's configuration rather than hardcoding a URL.
Related
| Read | To learn how to |
|---|---|
| Domains | Serve identity flows from your own hostname |
| Tenants | Verify the domains that redirect URIs are checked against |
| Authentication | Register OpenID clients and their grants |
| Branding | Style the pages users are redirected through |
| Deployments | Configure per-environment URLs across stages |