Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    oauth callback uri triage

    1

    Diagnose OAuth and OIDC redirect_uri mismatches by comparing request values, registrations, and provider rules.

    Free

    Security scanned
    oauth callback uri triage

    oauth callback uri triage

    Example session with this skill installed

    I'm getting a redirect_uri_mismatch in production with Auth0. Request uses https://api.acme.co/auth/callback but the console is set to https://api.acme.co/callback/auth. Which one is right?

    • Read your context and instructions
    • Compiled the oauth callback uri

    I have analyzed the provided URI strings for your Auth0 web application integration. There is a clear path discrepancy between the observed request and the provider registration.

    Status: CONFIRMED URI DIFFERENCE
    Best explanation: The authorization request is targeting a different path than what is whitelisted in the Auth0 dashboard.
    Confidence: High

    URI Comparison Analysis

    ComponentObserved Request (from user)Provider RegistrationMatch
    SchemehttpshttpsYes
    Hostapi.acme.coapi.acme.coYes
    Path/auth/callback/callback/authNo
    Query(none provided)(none provided)N/A

    Evidence and Rules

    String Difference: The path segments are transposed (auth/callback vs callback/auth). OAuth providers require an exact case-sensitive string match for the entire URI.
    2.

    Auth0 Rule: Per Auth0 documentation, the redirect_uri must exactly match one of the URIs listed in the "Allowed Callback URLs" field of your Application settings. Auth0 does not perform partial matching or path wildcards by default for security reasons.

    Next steps
    1.

    Verify App Config: Check your production environment variables (e.g., AUTH0_CALLBACK_URL) to see if /auth/callback is hardcoded there.
    2.

    Update Provider: If /auth/callback is the intended endpoint in your code, update the Auth0 dashboard to include https://api.acme.co/auth/callback.
    3. Check Middleware: Ensure no proxy or middleware is rewriting the path before it reaches your application logic.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    OAuth and OIDC integration failures often stall at the dreaded redirect_uri_mismatch error, where tiny differences in slashes, ports, or encoding break the entire flow. This skill triages these discrepancies by comparing observed request values against provider registrations and framework configurations.

    What it does

    • Divergence analysis identifies exact character-level differences in scheme, host, port, path, and query parameters.
    • Provider rule checking consults documented requirements for specific platforms regarding localhost, native app loopbacks, and trailing slashes.
    • Environment comparison isolates why sign-in works in local development but fails in staging or production.
    • Evidence classification distinguishes between actual URI mismatches and unrelated errors like access_denied or state failures.

    How it works

    1. Input collection starts by requesting the sanitized callback sent in the request, the provider registration, and the app's base-URL setting.
    2. Component parsing breaks down the URIs into segments to detect hidden mismatches like percent-encoding or case sensitivity.
    3. Rule validation matches findings against the specific OAuth provider's official documentation for that application type.
    4. Report generation delivers a table of differences and ranked, read-only next steps to resolve the mismatch.

    Frameworks & tools

    This tool works with any OAuth2 or OpenID Connect provider including Google, GitHub, Auth0, Okta, and Microsoft Entra. It supports triage for web and native apps across frameworks like NextAuth, Passport.js, and Spring Security.

    Why this beats prompting it yourself

    Generic prompts often miss subtle provider-specific rules, such as how different platforms handle dynamic ports on localhost or query strings in callbacks. This skill enforces a strict evidence-based workflow that prevents "hallucinated" fixes and focuses on character-perfect string matching.

    Use cases

    • Debugging why a local callback fails after deployment to a load-balanced environment.
    • Resolving port-binding mismatches for mobile or desktop native app authentication.
    • Verifying if a trailing slash or case-sensitive path is causing a provider-side rejection.
    • Confirming if a proxy or ingress controller is stripping the protocol or host during the redirect.

    Known limitations

    Does not perform token exchange, IAM audits, or live account changes. It requires the user to provide sanitized, non-secret string values for comparison.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean 14 days ago

    • Free to download with an account

    Listed14 days ago

    What's inside

    Frequently Asked Questions