AADSTS50011 — "The redirect URI specified in the request does not match the redirect URIs configured for the application." Entra ID refuses to send tokens or codes to an address the app registration has not explicitly declared. The comparison is exact: scheme, host, port, path and trailing slash all count.
AADSTS50011
Redirect URI mismatch
What it means
Common causes
The URI was never added to the app registration (new environment, new hostname, moved from localhost to a deployed URL).
Exact-match differences:
httpvshttps, missing or extra trailing slash, different port, different casing in the path.The URI is registered under the wrong platform type (e.g. registered as Web while the app performs a SPA/native flow, or vice versa).
Multiple environments (dev/test/prod) share one registration but only one environment's URI was added.
How to fix it
Copy the
redirect_urivalue out of the failing request (it is shown in the error page/URL), then register exactly that string: Entra admin center > App registrations > (app) > Authentication > Add a redirect URI.Put the URI under the correct platform: Web for server-side code flows, Single-page application for browser PKCE flows, Mobile and desktop for native clients.
For multi-environment apps, register every environment's URI (or use separate app registrations per environment).
Frequently asked
Does the redirect URI have to match exactly?
Yes — scheme, host, port, path and trailing slash are all compared. The only flexibility is that `http://localhost` allows arbitrary ports for native/dev flows. Copy the redirect_uri from the failing request and register that exact string.