Configurable authentication callback redirects
Projects can configure exact callback destinations for verification and approval results, with safe hosted fallbacks when no redirect is valid.
Mohith / 4 min readWhat changed
A project can now define exact callback URLs for supported authentication results. ZKAuth processes the security token first, then redirects only to a stored allowlisted destination.
Browser origins are configured separately because an origin authorizes a browser request surface, while a callback identifies an exact post-flow destination.
Primary redirect URLhttps://your-app.com/auth/callback
Allowed redirect URLshttps://your-app.com/auth/callbackhttps://staging.your-app.com/auth/callback
Allowed browser originshttps://your-app.comhttps://staging.your-app.comFailure behavior
When a callback is missing or unsafe, the flow stays on a constrained hosted result page instead of redirecting to an arbitrary URL. Callback query parameters are status signals, not authentication proof.
Production callbacks require HTTPS, and private-network destinations are rejected. Local HTTP remains a development exception for localhost rather than a general redirect allowance.