can1357/oh-my-pi · error · Error

OAuth redirect URI must use http or https

Error message

OAuth redirect URI must use http or https

What it means

resolveRedirectUri enforces that an OAuth redirect URI uses the http or https scheme. After parsing the configured URI, any other protocol (file:, ws:, custom schemes, or a missing/typo'd scheme) is rejected, since OAuth redirect URIs must be valid web URLs that the local callback listener or a TLS-terminated endpoint can serve.

Source

Thrown at packages/coding-agent/src/mcp/oauth-flow.ts:143

		return undefined;
	}
}

function isLoopbackHostname(hostname: string): boolean {
	return hostname === "localhost" || hostname === "127.0.0.1";
}

function resolveRedirectUri(redirectUri: string | undefined): string | undefined {
	const configured = redirectUri;
	const trimmed = configured?.trim();
	if (!trimmed) return undefined;
	if (trimmed !== configured) {
		throw new Error("OAuth redirect URI must not include surrounding whitespace");
	}

	const parsed = new URL(configured);
	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
		throw new Error("OAuth redirect URI must use http or https");
	}
	return configured;
}

function parseRedirectUri(redirectUri: string | undefined): URL | undefined {
	return redirectUri ? new URL(redirectUri) : undefined;
}

function getUriPort(uri: URL): number {
	if (uri.port !== "") return Number(uri.port);
	return uri.protocol === "https:" ? 443 : 80;
}

function validateRedirectConfig(config: MCPOAuthConfig, redirectUri: string | undefined): void {
	const parsed = parseRedirectUri(redirectUri);
	if (parsed?.protocol !== "https:" || !isLoopbackHostname(parsed.hostname)) {
		return;
	}

View on GitHub (pinned to 9690622007)

Solutions

1. Prefix the redirect URI with http:// or https:// (use http://localhost or http://127.0.0.1 for local loopback callbacks)
2. Fix the scheme typo if the URL was mistyped (htp:/htt:/htps:)
3. If you need a custom app scheme, register it with your provider and check the library docs for explicit support rather than forcing it into redirectUri

Example fix

// before
"redirectUri": "localhost:1455/auth/callback"
// after
"redirectUri": "http://localhost:1455/auth/callback"

const uri = config.oauth?.redirectUri;
if (uri != null) {
  const p = new URL(uri); // throws on unparseable
  if (p.protocol !== 'http:' && p.protocol !== 'https:') {
    throw new Error(`redirectUri must be http(s), got ${p.protocol}`);
  }
}

function isHttpUrl(s) {
  try { const p = new URL(s); return p.protocol === 'http:' || p.protocol === 'https:'; }
  catch { return false; }
}

try {
  startOAuthFlow(config);
} catch (e) {
  if (e.message.includes('must use http or https')) {
    throw new Error(`Fix oauth.redirectUri scheme: '${config.oauth.redirectUri}' needs http:// or https://`);
  } else throw e;
}

When it happens

Trigger: Configuring oauth.redirectUri with a non-http(s) scheme — e.g. "localhost:1455/callback" (no scheme), "ftp://...", "file://...", or a typo like "htp://localhost:1455" — then starting the MCP OAuth authorization flow.

Common situations: Omitting the scheme and assuming localhost defaults to http; typos in the scheme; copy-pasting an app-specific scheme (myapp://callback) intended for a different client type; misconfigured redirect in a shared config file.

Related errors

• OAuth resource URI must use http or https
• Destination option endpoint must be an absolute URL
• Destination option endpoint must use HTTP or HTTPS
• Destination option ${optionName} must be an absolute HTTP UR
• OAuth redirect URI must not include surrounding whitespace

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/a91f680ea403e09f. Report an issue: GitHub.