Redirect URLs

Several flows end by sending a person back to your app: a confirmation link in an email, a magic link, a password reset, an invitation, a return from Google. To stop attackers redirecting people to a fake site, Pawabase only sends them to addresses you have allowed.

Domains page — Users & auth → Domains: Site URL and Additional redirect URLs.

If a link in an email or a social sign-in does not return to your app, this is the first thing to check.

In Studio

Users & auth → Sign-in → Domains has a Redirects card:

Setting	Meaning
Site URL	Your application’s address, such as `https://myapp.com`. It is always allowed and is used inside emails
Additional redirect URLs	Other addresses that may receive a sign-in: a staging site, `http://localhost:5173`, or a mobile app’s link. A prefix covers everything beneath it

Save the page after editing.

Using a redirect in your app

You pass the address as redirectTo (redirect_to in Python) on the call that sends the email or starts the sign-in:

await pawabase.auth.signUp({ email, password, redirectTo: "https://myapp.com/welcome" });
await pawabase.auth.requestPasswordReset({ email, redirectTo: "https://myapp.com/reset" });
await pawabase.auth.signInWithMagicLink({ email, redirectTo: "https://myapp.com/auth/callback" });
pawabase.auth.signInWithOAuth("google", { redirectTo: "https://myapp.com/" });

pb.auth.sign_up(email=email, password=password, redirect_to="https://myapp.com/welcome")
pb.auth.request_password_reset(email=email, redirect_to="https://myapp.com/reset")
pb.auth.sign_in_with_magic_link(email=email, redirect_to="https://myapp.com/auth/callback")

If you leave redirectTo out, people return to the Site URL.

Rules of thumb

List exactly the addresses you use. A prefix is convenient, but https://myapp.com covers every path on that site.
Keep localhost entries in development only.
Use HTTPS for everything except localhost.
Mobile apps use a custom scheme (myapp://auth/callback). Register the same scheme in the app.
Invitations use the same list: the invite’s redirectTo must be allowed.

Troubleshooting

Symptom	Cause
”Redirect not allowed” when sending an email	The address is not in the list, or has a different scheme or port
Link opens the Site URL instead of my page	`redirectTo` was not passed
Works locally, fails in production	`localhost` was only added to `development` (correct), but production lacks your real address
Social sign-in returns an error page	The provider’s own redirect settings also need Pawabase’s callback. See Social sign-in

Email verification

Uses a redirect.

Social sign-in

Returns to a redirect.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

Using a redirect in your app

Rules of thumb

Troubleshooting

Email verification

Social sign-in

​In Studio

​Using a redirect in your app

​Rules of thumb

​Troubleshooting

Email verification

Social sign-in

In Studio

Using a redirect in your app

Rules of thumb

Troubleshooting