How do I install the OAUTH Redirect And Domain Strategy skill?

Run npx skillmds@latest add aibot88/oauth-redirect-and-domain-strategy in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is OAUTH Redirect And Domain Strategy safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with OAUTH Redirect And Domain Strategy?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is OAUTH Redirect And Domain Strategy free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published OAUTH Redirect And Domain Strategy?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

OAUTH Redirect And Domain Strategy by aibot88

Name: OAUTH Redirect And Domain Strategy
Rating: 4.666666666666667 (3 reviews)
Author: aibot88

OAUTH Redirect And Domain Strategy

Design Connected App OAuth callback URLs, My Domain naming, Enhanced Domains cutover, and cross-environment redirect handling. Trigger keywords: oauth redirect uri, connected app callback, my domain, enhanced domains, sandbox url change, oauth login host. Does NOT cover: end-user login flow UX, Experience Cloud branding, or SAML-only SSO configuration.

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

OAuth Redirect And Domain Strategy

The Moving Parts

My Domain — every org has one. Login host is now acme.my.salesforce.com (prod) or acme--sandbox.sandbox.my.salesforce.com (sandbox). Classic login.salesforce.com and test.salesforce.com still work for initial auth but redirect to My Domain.
Enhanced Domains — enforced on all orgs. URL format stabilises across orgs; old URL patterns may break.
Connected App Callback URLs — whitelist of exact match redirect URIs. Mismatch at runtime = redirect_uri_mismatch error.
Login host — what the client sends token requests to. login.salesforce.com works for prod; for sandboxes prefer the sandbox My Domain directly.

Callback URL Design

Exact match, not prefix. https://app.example.com/callback does NOT match https://app.example.com/callback?x=1 automatically.
Put the callback URLs for every environment the Connected App serves into the Connected App definition — prod callback AND uat AND dev. Missing one at cutover = downtime.
Do not use wildcards — they are not supported.

Per-Environment Pattern

Environment	Login Host	Client Callback
Production	login.salesforce.com	https://app.example.com/callback
UAT	test.salesforce.com	https://uat.example.com/callback
Developer sandbox	test.salesforce.com	https://dev.example.com/callback

Clients usually have a per-env config toggle for base URL + login host.

My Domain Naming

Short, lowercased, no dashes where avoidable.
Keep it the same across refreshes — rename = client updates.
For sandboxes: Salesforce appends --<sandboxname>. Clients should read the host from an env var, not hardcode.

Enhanced Domains Cutover

Old URL patterns (c.na123.visual.force.com, etc.) change.
Inventory hardcoded URLs in:
- Apex (string literals, metadata mention).
- LWC/Aura (fetch targets).
- External systems (webhook registrations, integrations).
- Email templates (absolute links).
Run the pre-cutover "known issues" scanner Salesforce provides.
Rehearse in a sandbox first.

Login Host Strategy

Prod clients: either login.salesforce.com or the org's My Domain directly. My Domain is preferred (no redirect bounce).
Sandbox clients: the sandbox My Domain directly. test.salesforce.com redirects and some OAuth libraries handle that redirect awkwardly.

Recommended Workflow

Enumerate Connected Apps + environments.
Build the redirect URI matrix (exact URLs per env).
Audit hardcoded URLs across Apex, LWC, metadata, email templates, and external registrations.
Standardise My Domain name; avoid renames.
Point OAuth clients at the org's My Domain as the login host.
Rehearse Enhanced Domains cutover in a sandbox.
Monitor redirect_uri_mismatch rates post-change.

Official Sources Used

Connected App OAuth Configuration — https://help.salesforce.com/s/articleView?id=sf.connected_app_create_api_integration.htm
My Domain Overview — https://help.salesforce.com/s/articleView?id=sf.domain_name_overview.htm
Enhanced Domains — https://help.salesforce.com/s/articleView?id=sf.domain_name_enhanced_domains_overview.htm

---name: oauth-redirect-and-domain-strategydescription: Design Connected App OAuth callback URLs, My Domain naming, Enhanced Domains cutover, and cross-environment redirect handling. Trigger keywords: oauth redirect uri, connected app callback, my domain, enhanced domains, sandbox url change, oauth login host. Does NOT cover: end-user login flow UX, Experience Cloud branding, or SAML-only SSO configuration.--- # OAuth Redirect And Domain Strategy ## The Moving Parts - **My Domain** — every org has one. Login host is now `acme.my.salesforce.com` (prod) or `acme--sandbox.sandbox.my.salesforce.com` (sandbox). Classic `login.salesforce.com` and `test.salesforce.com` still work for initial auth but redirect to My Domain. - **Enhanced Domains** — enforced on all orgs. URL format stabilises across orgs; old URL patterns may break. - **Connected App Callback URLs** — whitelist of exact match redirect URIs. Mismatch at runtime = `redirect_uri_mismatch` error. - **Login host** — what the client sends token requests to. `login.salesforce.com` works for prod; for sandboxes prefer the sandbox My Domain directly. ## Callback URL Design - **Exact match, not prefix**. `https://app.example.com/callback` does NOT match `https://app.example.com/callback?x=1` automatically. - Put the callback URLs for **every environment** the Connected App serves into the Connected App definition — prod callback AND uat AND dev. Missing one at cutover = downtime. - Do not use wildcards — they are not supported. ## Per-Environment Pattern | Environment | Login Host | Client Callback | |---|---|---| | Production | login.salesforce.com | https://app.example.com/callback | | UAT | test.salesforce.com | https://uat.example.com/callback | | Developer sandbox | test.salesforce.com | https://dev.example.com/callback | Clients usually have a per-env config toggle for base URL + login host. ## My Domain Naming - Short, lowercased, no dashes where avoidable. - Keep it the same across refreshes — rename = client updates. - For sandboxes: Salesforce appends `--<sandboxname>`. Clients should read the host from an env var, not hardcode. ## Enhanced Domains Cutover - Old URL patterns (`c.na123.visual.force.com`, etc.) change. - Inventory hardcoded URLs in: - Apex (string literals, metadata mention). - LWC/Aura (fetch targets). - External systems (webhook registrations, integrations). - Email templates (absolute links). - Run the pre-cutover "known issues" scanner Salesforce provides. - Rehearse in a sandbox first. ## Login Host Strategy - **Prod clients:** either `login.salesforce.com` or the org's My Domain directly. My Domain is preferred (no redirect bounce). - **Sandbox clients:** the sandbox My Domain directly. `test.salesforce.com` redirects and some OAuth libraries handle that redirect awkwardly. ## Recommended Workflow 1. Enumerate Connected Apps + environments. 2. Build the redirect URI matrix (exact URLs per env). 3. Audit hardcoded URLs across Apex, LWC, metadata, email templates, and external registrations. 4. Standardise My Domain name; avoid renames. 5. Point OAuth clients at the org's My Domain as the login host. 6. Rehearse Enhanced Domains cutover in a sandbox. 7. Monitor `redirect_uri_mismatch` rates post-change. ## Official Sources Used - Connected App OAuth Configuration — https://help.salesforce.com/s/articleView?id=sf.connected_app_create_api_integration.htm - My Domain Overview — https://help.salesforce.com/s/articleView?id=sf.domain_name_overview.htm - Enhanced Domains — https://help.salesforce.com/s/articleView?id=sf.domain_name_enhanced_domains_overview.htm

Frequently asked questions