- Ya
- 4 Septemba 2026, 23:41 UTC
- Mwandishi
- Kamo
- Ahadi ya
- e2bd85b
This endpoint is where a member finds the string they paste into Google's console, so it is the endpoint that was wrong: it returned only the redirect the org had typed, and the screen filled the blank with a hardcoded api.kamocrm.com — the platform's hostname, in front of a white-labelled tenant, for an app that tenant registered itself. callbackUrls is server-computed and read-only. The host comes from this organization's verified domain and the paths from OAuthCallbackPaths, which is the same table EmailService, MediaService and VOIPService build their own redirect from — so the address shown here and the address sent on the wire are one string by construction rather than by agreement. Getting that wrong has no local symptom; it surfaces inside a third party, weeks later, as a redirect_uri_mismatch. A list, not a string: one Microsoft registration is the mailbox app and the Teams-meetings app, and each half completes on its own service's callback, so Entra needs both registered and the screen has to say so. Empty for a provider whose callback Kamo does not serve — X has no connect flow, and every payroll provider completes on a kamo-internal page on the workspace host. Those keep their editable field rather than being handed a plausible-looking api.* address nothing listens on. OrgDomains.verifiedRootDomain now delegates to the shared predicate for the same reason: two copies of the rule would let this screen and the services disagree about which domain routes.