# OAuth callbacks

> Use a stable URL as the redirect URI for OAuth integrations.

OAuth providers want a single, pre-registered redirect URI. A changing
`localhost:<port>` is awkward to register and breaks when the port moves.
routeup gives you a stable URL to register once.

## Local-only providers

Many providers accept an HTTPS `localhost` redirect. For those, a local route is
enough, no server or token needed:

```bash
routeup serve example-app --port 3000
```

Register:

```txt
https://example-app.localhost/oauth/callback
```

Because routeup serves trusted HTTPS on `*.localhost`, secure cookies and
`https`-only SDKs exercise production-like secure-origin behavior locally.

## Providers that require a public URL

Some providers reject `localhost` or need to reach you directly. Expose the route
and register the public URL. Configure public exposure first using
[Exposing publicly](/docs/getting-started/exposing-publicly). This example assumes your saved token allows
`*.team.routeup.dev`:

```bash
routeup serve example-app --port 3000 --expose
```

```txt
https://example-app.team.routeup.dev/oauth/callback
```

## Why the stable name matters

The route name and token namespace do not depend on the underlying dev port, so
you can request the same redirect URI on each run. Public claims remain
subject to the server's normal conflict rules. See [Routes](/docs/concepts/routes).