AuthTrace › Guides

Fix AADSTS50011 and redirect_uri mismatch errors

The user clicks "Sign in" and the identity provider stops them straight away, before any password prompt: AADSTS50011: The redirect URI '…' specified in the request does not match the redirect URIs configured for the application. Other providers say the same thing in their own words:

What it means

An app tells the identity provider where to send the user back: the redirect_uri parameter in an OpenID Connect or OAuth request, or the AssertionConsumerServiceURL in a SAML AuthnRequest. The provider only sends codes, tokens or assertions to addresses registered on the app beforehand - otherwise anyone could start a sign-in for your app and collect the result at their own URL. Registered addresses are compared as exact strings, with very few exceptions.

Find the exact value the app sent

The error page usually quotes it, but URL-encoded and sometimes truncated. To get it exactly:

1. Open DevTools on the app tab, choose the AuthTrace panel, and click Sign in.
2. Select the authorize request (or the SAML AuthnRequest). AuthTrace decodes it and shows redirect_uri or AssertionConsumerServiceURL as plain text, with the provider's error explained next to it.
3. Compare it character by character with the list registered on the app.

Without AuthTrace: Network panel › the request to /authorize (Entra: login.microsoftonline.com/…/oauth2/v2.0/authorize) › Payload › redirect_uri.

The usual differences

• http vs https: the app runs behind a TLS-terminating proxy or load balancer and builds its own URL from the plain-HTTP request it receives. Make the app trust X-Forwarded-Proto (and X-Forwarded-Host), or configure its public base URL explicitly. Entra ID only accepts http:// for localhost.
• Trailing slash or path: /signin-oidc vs /signin-oidc/, /auth/callback vs /callback.
• Host: www. vs the bare domain, a new hostname after a migration, or a staging hostname.
• Port: localhost:5000 registered, app now runs on localhost:5173.
• Wrong app or tenant: the client_id in the request is a different app registration from the one you edited. Check it in the same request.
• Wrong platform (Entra ID): the URI is registered under Web but the app is a single-page app, or vice versa. A browser app redeeming the code itself needs it under Single-page application, otherwise the token call fails with AADSTS9002326 instead.
• Wildcards: most providers don't allow them, or only in limited places. Register each URI explicitly.

Where to register it

• Microsoft Entra ID, OIDC/OAuth: App registrations › your app › Authentication › add the URI under the right platform.
• Microsoft Entra ID, SAML: Enterprise applications › your app › Single sign-on › Basic SAML Configuration › Reply URL (Assertion Consumer Service URL).
• Google: Google Cloud console › APIs & Services › Credentials › your OAuth client › Authorized redirect URIs.
• Okta: Applications › your app › General › Sign-in redirect URIs.
• Auth0: Applications › your app › Settings › Allowed Callback URLs.
• Keycloak: Clients › your client › Settings › Valid redirect URIs.

Changes can take a few minutes to apply. If the error persists, sign in again in a fresh private window so a cached error page isn't fooling you.

Better: fix the app, not the list

If the value the app sends is wrong (http behind a proxy, an internal hostname), registering it just spreads the mistake - and an http:// redirect URI on a public host is a security risk. Register the public HTTPS URL and fix the app so it sends that.

Once the redirect works, the next step can still fail at the token endpoint with invalid_grant if the token request sends a different redirect_uri - see fixing invalid_grant.

More guides