A signed state payload carrying the account id, user id, starting origin, timestamp and popup flag, plus a kind marker so one callback can serve several products. The callback validates the signature and a 15-minute expiry, then resolves the return destination — preferring the account's own subdomain when it can name it.
Also called: URL blocked · redirect URI · connect from my subdomain · OAuth state
- 1The connect route packs a signed state and redirects to the provider's dialog with the constant registered redirect URI.
- 2The provider returns to that one URI with the code and state.
- 3The state is verified and checked for expiry.
- 4The kind marker routes the callback to the right handler (calendar, search console, ads).
- 5The browser is returned to the tenant subdomain when resolvable, otherwise to the origin from the state.
Both providers document the same constraint. The Meta route: 'ALWAYS the apex — the app is PUBLISHED (live mode), and Facebook refuses any redirect URI that isn't exactly whitelisted, localhost included (Keith hit "URL Blocked" starting from dev). Dev and prod share one database, so the production callback stores the connection and then sends the browser back to the ORIGIN in the signed state.' The subdomain preference has its own recorded incident: 'subdomains are the canonical tenant context and dodge every apex-host gate (Keith connected from bare localhost and the owner-gate ate his landing)'.
- Providers refuse redirect URIs that are not exactly whitelisted, breaking development.
- A callback on the apex could not tell which tenant or surface the flow began on.
- Returning to the apex tripped host-based access gates.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →