Redirect URIs

Configure allowedRedirectUris for Fabric SSO, local rayfin dev ports, static hosting origins, and retained frontend port aliases.

services.auth.allowedRedirectUris is the allow-list of origins Rayfin can use for Fabric SSO handoffs and auth callbacks. Keep it scoped to origins that serve your app.

Configure the local origin

rayfin/rayfin.yml

services:
  auth:
    enabled: true
    fabric:
      enabled: true
    allowedRedirectUris:
      - http://localhost:5173

Fabric SSO's popup flow works from any listed origin, including a local Vite server. Embedded iframe flows require the app to run inside Fabric.

How rayfin dev updates local redirects

rayfin dev resolves a stable frontend port and writes it as RAYFIN_PUBLIC_FRONTEND_PORT in rayfin/.env. The backend is patched to allow both http://localhost:<port> and http://127.0.0.1:<port>.

If the previous port is still occupied, Rayfin records it in RAYFIN_FRONTEND_DEV_PORT_ALIASES and keeps that origin allow-listed until the old process stops. Remove stale aliases when they are no longer serving the app.

How rayfin up updates deployed redirects

When static hosting is enabled, rayfin up registers the deployed static hosting origin. For example:

rayfin/rayfin.yml

services:
  auth:
    allowedRedirectUris:
      - http://localhost:5173
      - https://bold-river-a3f1bc9d02-westus2.webapp.example.com

You do not need to add the hosted origin before the first deploy.

Keep the list tight

Include the local dev origins and the deployed Fabric hosting origins you use.
Do not add wildcards.
Do not add third-party origins.
Review the list after copying rayfin.yml between projects.

PromptAudit Rayfin redirect URIs

Inspect `services.auth.allowedRedirectUris` in rayfin/rayfin.yml and the local port values in rayfin/.env. Classify each URI as a current `rayfin dev` origin, a retained `RAYFIN_FRONTEND_DEV_PORT_ALIASES` origin, a deployed static-hosting origin, or an unknown origin. Propose a trimmed list before editing anything.

Troubleshooting

If local sign-in fails after Vite slides to a new port, restart npm run dev so Rayfin registers the new origin.
If a deployed app fails the auth handoff, run npx rayfin up so the hosting origin is recorded and synced.
If .env.local is hand-managed, do not pass --no-emit-env unless it already has the current backend and port values.

Something wrong on this page?Report an issueEdit this page