Significant-Gravitas/AutoGPT · error · HTTPException

Callback URL origin is not allowed. Allowed origins: {settin

Error message

Callback URL origin is not allowed. Allowed origins: {settings.config.external_oauth_callback_origins}

What it means

Raised (HTTP 400) by the external OAuth initiate endpoint when `validate_callback_url` rejects the supplied `callback_url`. Validation extracts the origin (`scheme://netloc`) and requires an exact match against `settings.config.external_oauth_callback_origins`; localhost is allowed with any port only if some allowed origin also uses localhost. Malformed URLs also fail (the parser wraps everything in try/except returning False).

Source

Thrown at autogpt_platform/backend/backend/api/external/v1/integrations.py:338

    provider: Annotated[str, Path(title="The OAuth provider")],
    request: OAuthInitiateRequest,
    auth: APIAuthorizationInfo = Security(
        require_permission(APIKeyPermission.MANAGE_INTEGRATIONS)
    ),
) -> OAuthInitiateResponse:
    """
    Initiate an OAuth flow for an external application.

    This endpoint allows external apps to start an OAuth flow with a custom
    callback URL. The callback URL must be from an allowed origin configured
    in the platform settings.

    Returns a login URL to redirect the user to, along with a state token
    for CSRF protection.
    """
    # Validate callback URL
    if not validate_callback_url(request.callback_url):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=(
                f"Callback URL origin is not allowed. "
                f"Allowed origins: {settings.config.external_oauth_callback_origins}",
            ),
        )

    # Validate provider
    try:
        provider_name = ProviderName(provider)
    except ValueError:
        # Check if it's a dynamically registered provider
        if provider not in HANDLERS_BY_NAME:
            raise HTTPException(
                status_code=status.HTTP_404_NOT_FOUND,
                detail=f"Provider '{provider}' not found",
            )
        provider_name = provider

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Add your application's exact origin (scheme + host + port, no path) to `external_oauth_callback_origins` in platform settings and retry.
2. For local dev, either point the callback at an allowed localhost origin or add your dev origin to the allow list.
3. Double-check scheme (`https` vs `http`) and port; matching is exact string equality on the origin.
4. Confirm the URL is well-formed — `validate_callback_url` returns False for unparseable URLs.

Example fix

# before
POST /integrations/github/oauth/authorize
{"callback_url": "http://my-app.dev:3000/auth/callback"}  # 400: origin not allowed

# after: add to platform config (settings.config.external_oauth_callback_origins)
external_oauth_callback_origins=["http://my-app.dev:3000", "https://app.example.com"]

from urllib.parse import urlparse

ALLOWED = set(get_platform_setting("external_oauth_callback_origins"))

def callback_allowed(url: str) -> bool:
    p = urlparse(url)
    origin = f"{p.scheme}://{p.netloc}"
    return origin in ALLOWED or (p.hostname == "localhost" and any(urlparse(a).hostname == "localhost" for a in ALLOWED))

assert callback_allowed(callback_url), "origin not in external_oauth_callback_origins"

try:
    client.post(f"/integrations/{provider}/oauth/authorize", json={"callback_url": callback_url})
except HTTPError as e:
    if e.response.status_code == 400 and "origin is not allowed" in e.response.text:
        raise ConfigError("Add origin to external_oauth_callback_origins") from e
    raise

When it happens

Trigger: POST `/api/external-api/v1/integrations/{provider}/oauth/authorize` with a `callback_url` whose origin (scheme + host + port) is not listed in `external_oauth_callback_origins` — e.g. `http://localhost:5173/callback` when only `https://app.example.com` is allowed, or an `http` vs `https` mismatch, or a URL with a typo in the host.

Common situations: Local development against a remote/staging backend whose allow list only contains production origins; deploying an external app on a new domain without updating the platform setting; using `127.0.0.1` instead of `localhost` (hostname check is literal); trailing-slash or port differences between the allow-list entry and the actual callback.

Related errors

• Integration with provider '{provider_name}' is not configure
• Integration with provider '{provider_name.value}' is not con
• Unsupported grant_type: {request.grant_type}. Must be 'autho
• Download failed: ${res.status}
• Invalid form

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/570700090385314d. Report an issue: GitHub.