Redirect URI
In a redirect-based OAuth flow, a redirect URI is the client endpoint to which the authorization server sends the user's browser with the authorization response.
Where the browser returns
In an OAuth authorization-code flow, the browser carries the authorization response back to the client at this endpoint. The client then exchanges the code at the authorization server’s token endpoint. The redirect URI brings the browser back to the client; it is not the API endpoint where the client sends an access token.
RFC 9700 requires exact matching when the authorization server compares a redirect URI with preregistered values. It includes a port-number exception for native applications using localhost redirects. That exception should not become a general rule allowing arbitrary destinations or wildcard paths for web applications.
Reviewing registered callbacks
Go through the registered return addresses with the application owner. Confirm their purpose and ownership, and remove obsolete entries through the normal change process after checking dependencies.
Use an authorized test to confirm that a mismatched callback is rejected under the applicable client profile. Also review whether a valid callback forwards the browser to arbitrary destinations, which can undermine the return-path boundary. Keep this review separate from PKCE and other transaction checks: getting the callback right does not secure every later token or API request.