> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended**:
> ```bash
> npx @scalekit-inc/cli setup
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for 40+ agents.
> Features: full-stack-auth, agent-auth, mcp-auth, modular-sso, modular-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# How to register a callback endpoint

Learn how to register a callback endpoint in the Scalekit dashboard.
In the authentication flow for a user, a callback endpoint is the endpoint that Scalekit remembers about your application, trusts it, and sends a authentication grant (code). It further expects your application to exchange the code for a user token and user profile.

This needs to be pre-registered in the Scalekit dashboard.

Go to **Dashboard** > **Authentication** > **Redirect URLS** > **Allowed Callback URLs** and add the callback endpoint.

> Image: Screenshot

Your redirect URIs must meet specific requirements that vary between development and production environments:

| Requirement | Development | Production |
| ----------- | ----------- | ---------- |
| Supported schemes | <span class="icon-text"> `http`  `https`  `{scheme}`</span> | <span class="icon-text"> `https`  `{scheme}`</span> |
| Localhost support | <span class="icon-text"> Allowed</span> | <span class="icon-text"> Not allowed</span> |
| Wildcard domains | <span class="icon-text"> Allowed</span> | <span class="icon-text"> Not allowed</span> |
| URI length limit | 256 characters | 256 characters |
| Query parameters | <span class="icon-text"> Not allowed</span> | <span class="icon-text"> Not allowed</span> |
| URL fragments | <span class="icon-text"> Not allowed</span> | <span class="icon-text"> Not allowed</span> |

Wildcards can simplify testing in development environments, but they must follow specific patterns:

| Validation rule                                                                     | Examples                                                                                                                                                                                                          |
| ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Wildcards cannot be used as root-level domains                          | <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://*.com`</div> <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://*.acmecorp.com`</div> <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://auth-*.acmecorp.com`</div> |
| Only one wildcard character is allowed per URI                                 | <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://*.*.acmecorp.com`</div> <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://*.acmecorp.com`</div>                                                                            |
| Wildcards must be in the hostname component only     | <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://acmecorp.*.com`</div> <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://*.acmecorp.com`</div>                                                                  |
| Wildcards must be in the outermost subdomain | <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://auth.*.acmecorp.com`</div> <div style="display: inline-flex; align-items: center; gap: 0.5rem;"> `https://*.auth.acmecorp.com`</div>                                                        |

> caution
>
> According to the [OAuth 2.0 specification](https://tools.ietf.org/html/rfc6749#section-3.1.2), redirect URIs must be absolute URIs. For development convenience, Scalekit relaxes this restriction slightly by allowing wildcards in development environments.


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |