Callback URL mismatch. The provided redirect_uri is not in the list of allowed callback URLs.

By Ohad Krispin, founder of VibeRaven · LinkedIn

"Callback URL mismatch. The provided redirect_uri is not in the list of allowed callback URLs." means the redirect_uri your app sent to Auth0 is not an exact entry in the application's Allowed Callback URLs. With @auth0/nextjs-auth0 v4 that value is APP_BASE_URL plus /auth/callback, or the request host plus /auth/callback when APP_BASE_URL is not set. It works locally because http://localhost:3000/auth/callback is registered, and fails on a Vercel preview or a custom domain because that origin is not. Read the redirect_uri in the address bar of the Auth0 error page, add that exact value to Allowed Callback URLs, add the origin to Allowed Logout URLs, save, and sign in again. We ran the SDK on 2026-10-31 to see which redirect_uri it sends; the Auth0 error page itself we did not reproduce.

Which redirect_uri does nextjs-auth0 v4 send on Vercel?

The SDK resolves the base URL in one of three ways: a static APP_BASE_URL, a comma-separated allow-list of origins, or no APP_BASE_URL at all, in which case it infers the origin from the request host (EXAMPLES.md, Dynamic Application Base URLs). The callback path is /auth/callback in v4; v3 used /api/auth/callback. In a run of @auth0/nextjs-auth0 4.33.0 on 2026-10-31, with a fake tenant and a mocked discovery response, a login request to a preview host gave these redirect_uri values.

The README describes a single URL and says comma-separated values are not supported, while EXAMPLES.md documents the allow-list and the 4.33.0 source splits APP_BASE_URL on commas. If you use a list, run it once on a preview before you rely on it. A host that is not in the list throws InvalidConfigurationError: "APP_BASE_URL is not configured as a static string, and the APP_BASE_URL configuration does not contain a match for the current request origin."

Request to https://app-git-feature-team.vercel.app/auth/login

APP_BASE_URL=https://app.example.com
  redirect_uri=https://app.example.com/auth/callback
APP_BASE_URL not set
  redirect_uri=https://app-git-feature-team.vercel.app/auth/callback
APP_BASE_URL=https://app.example.com,https://app-git-feature-team.vercel.app
  redirect_uri=https://app-git-feature-team.vercel.app/auth/callback

Can I allow every Vercel preview with a wildcard callback URL?

Auth0 allows a wildcard only in the subdomain part of the host: one wildcard per URL, in the subdomain furthest from the root, and it matches one level only. Auth0 also says wildcard placeholders in subdomains should not be used in production applications, and that callback wildcards can make an application vulnerable to attacks. The nextjs-auth0 v4 migration guide shows https://*.vercel.app/auth/callback as an example for dynamic URLs. As a pattern it matches any single-label subdomain of vercel.app, not only your project's.

Vercel gives each preview a branch-specific URL that always points to the latest changes on that branch, and a commit-specific URL for each deployment. A narrower option is to register the stable branch URL of the branches you test, or to give a staging branch its own domain.

Why does it still fail after I added the URL?

Auth0 compares callback URLs as exact strings. Scheme, port, a trailing slash, a different subdomain and a different environment all count as a difference, and so does a hidden space or line break from copy and paste. Auth0's own quickstart advises retyping the value by hand and comparing it with the redirect_uri in the address bar. After an upgrade from v3, check the path first: the default login route moved from /api/auth/login to /auth/login, so an old /api/auth/callback entry no longer matches.

If sign-in gets past Auth0 and then ends on the wrong host, the cause is a static APP_BASE_URL on a preview; see The state parameter is invalid. (nextjs-auth0 on Vercel). For the same error with Google as the provider, see the general OAuth callback mismatch guide.

Checklist

How to fix it, then check the fix

01Start sign-in on the failing deployment. On the Auth0 error page, copy the redirect_uri query parameter from the address bar: that is the value Auth0 compared.
02In the Auth0 Dashboard, open Applications, then your application, then Settings and Application URIs. Add the exact callback to Allowed Callback URLs and the origin to Allowed Logout URLs. Separate several values with commas.

Use the v4 paths, and the https scheme for anything on Vercel, with no trailing slash:

Allowed Callback URLs:  https://app.example.com/auth/callback
Allowed Logout URLs:    https://app.example.com

04
Set APP_BASE_URL per environment in Vercel. Give Production its custom domain; on Preview either leave it unset, so the host is inferred, or list only the origins that environment serves:
```
vercel env add APP_BASE_URL production
```
05Coming from v3? Rename AUTH0_BASE_URL to APP_BASE_URL and AUTH0_ISSUER_BASE_URL to AUTH0_DOMAIN, and replace any /api/auth/callback entry with /auth/callback.
06Redeploy, because Vercel applies changed variables only to new deployments. Open /auth/login on the deployment: you should reach the Auth0 login page and then land back on your app, not on the error page.

Sources

Official docs behind this checklist

More Vercel errors · More Next.js errors · More Auth0 errors

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Why does it work on production and fail on every preview?

Each preview deployment has its own generated URL, and Auth0 redirects only to URLs registered in Allowed Callback URLs. A static APP_BASE_URL set to the production domain hides the problem by sending the production callback from every preview, and moves it to the state check instead.

Do I need the Allowed Logout URLs entry too?

Yes. Auth0 says the URL used in returnTo must be listed in Allowed Logout URLs, and the nextjs-auth0 README asks you to add your base URL there next to the callback.

Is a wildcard safe for production?

Auth0 says wildcard placeholders in subdomains should not be used in production applications. Register exact URLs for production and keep any wildcard to a test tenant.