# invalid_redirect_uri

One or more redirect URIs in a dynamic registration are invalid (RFC 7591 §3.2.2).

## Meaning

Sent by `/register` and `PUT /register/{client_id}` with `400` when `redirect_uris` is
missing for a client with the `authorization_code` or `implicit` grant, holds more than 8
entries, or holds a URI this server does not accept, such as a native client redirect
that is not a loopback address, or a loopback redirect for a web client registering the
`implicit` grant (OIDC Registration 1.0 §2). A `post_logout_redirect_uris` entry that is not a valid URI is refused
the same way. An entry that is not an absolute URI at all fails schema validation and
gets a `validation_error` problem document instead.

## Impact

The client is not registered or updated. A registrant bug or an unsupported redirect
scheme; no user is affected yet.

## Diagnosis

1. `error_description` names the field and the value refused.
2. The `client.registration.attempted` record has reason `invalid_redirect_uri`, the
   metadata field, and a cause such as `parameter_missing`, `too_many_values`,
   `uri_invalid`, `native_redirect_not_loopback` or `implicit_redirect_loopback`.

## Mitigation

- As a client developer: register `https` redirect URIs exactly as the client will send
  them, at most 8. See [Redirect URIs](https://www.nauthera.io/docs/v1/clients#redirect-uris).
- As an operator: for redirects dynamic registration cannot express, register the client
  through the operator or the AdminService instead.
- As a user: nothing to do.

## Escalation

If a URI allowed by RFC 7591 and the docs is refused, open an issue with the request id,
the server version and the refused value. Never attach the initial access token.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.