- Shipped
- September 4, 2026 at 11:45 PM UTC
- Author
- Kamo
- Commit
- d75e986
This is the screen the whole change is for. A member setting up Google Workspace with their organization's own OAuth app comes here to find the address to paste into the Google console — and found api.kamocrm.com, hardcoded in the catalog, for an organization that has verified its own domain and whose members never see Kamo's hostname anywhere else. The address now comes from the server, per organization, and is rendered read-only rather than as a text box. That is not a styling choice: nothing ever read a value typed into that field. EmailService, MediaService and VOIPService each replay their own configured redirect on the token exchange, so a URI an org typed here was shown back to them and ignored — and an org that typed one which disagreed with what the service sends got a redirect_uri_mismatch from inside Google with nothing on this screen to explain it. It is no longer sent on save either, so no stored string can look authoritative on the next load. Every callback is rendered, not just the first. One Microsoft registration is the mailbox app and the Teams-meetings app; each half completes on its own service's callback, so Entra needs both and showing one leaves the other failing with no clue which URI was sent. The same applies to the platform card, so callbackUrl became callbackUrls there too — and Microsoft, Zoho, Zoom, Teams, Meta and Canva gained the entries they never had, which had left a platform operator with no address to register at all. The catalog's list stays platform-only and says so. Kamo's own app always runs on the platform host; reusing that list for an organization would put the platform's hostname in front of a white-labelled tenant and tell them to register an address their flow never sends.