error fix
n8n OAuth Callback Error: Redirect URL Checklist
Copy the OAuth redirect URL from the n8n credential, add it exactly to the provider app, confirm HTTPS and public domain settings, then re-check scopes and credential type.
Match your incident first
Start with the symptom you can prove
OAuth provider says redirect_uri_mismatch
First check: Copy the callback URL from the credential screen and compare scheme, host, path, and trailing slash.
Wrong fix to avoid: Do not guess the callback path from memory or old screenshots.
Verify: Provider redirects back to n8n and the credential test passes.
Credential works in editor but fails in production execution
First check: Check credential test, scopes, token refresh errors, and worker/main env consistency.
Wrong fix to avoid: Do not recreate the workflow before testing the credential independently.
Verify: A production execution using the credential succeeds on the same node.
Credentials type is not known
First check: Compare installed node packages and n8n version across main and worker containers.
Wrong fix to avoid: Do not import workflows into production until the credential type exists there.
Verify: The credential type appears in the UI and a test execution can load it.
- Use when
- n8n credentials, OAuth2, self-hosted, n8n Cloud
- First check
- Copy the callback URL shown in n8n and compare it exactly with the provider app redirect URL.
- Time to check
- 5-10 minutes
- Next step
- Match the symptom, then run the verification checks.
Independent third-party notes. n8n is a trademark of its owner and is referenced only for compatibility and troubleshooting context.
Quick Answer
Copy the OAuth redirect URL from the n8n credential, add it exactly to the provider app, confirm HTTPS and public domain settings, then re-check scopes and credential type.
Does this match your symptom?
OAuth callback or credentials are blocking execution
The OAuth login does not return to n8n, credentials reconnect but still fail, or provider scopes and callback URLs do not match production.
First check: Copy the callback URL shown in n8n and compare it exactly with the provider app redirect URL.
Problem Pattern
OAuth callback errors usually happen when the app provider has a redirect URL that does not exactly match n8n's callback URL, or when self-hosted public URL and proxy settings are wrong.
Version awareness
Last reviewed 2026-05-21
Key Facts
- Redirect dependency
- OAuth apps must send the user back to the redirect URL expected by n8n.
- Credential context
- HTTP Request credentials support OAuth2 for services that use it.
- Provider-specific
- Google, Linear, and other services each have their own OAuth app settings and scopes.
- Self-hosted risk
- Wrong public URL or reverse proxy configuration can produce an unusable callback URL.
Production Diagnostic Matrix
Turn checks into a brief| Exact symptom or log | Likely cause | First check | Wrong fix to avoid | Verification |
|---|---|---|---|---|
| OAuth provider says redirect_uri_mismatch | Provider app redirect URI does not exactly match the callback URL n8n generated. | Copy the callback URL from the credential screen and compare scheme, host, path, and trailing slash. | Do not guess the callback path from memory or old screenshots. | Provider redirects back to n8n and the credential test passes. |
| Credential works in editor but fails in production execution | Token expired, scope missing, worker cannot decrypt credential, or different runtime env is used. | Check credential test, scopes, token refresh errors, and worker/main env consistency. | Do not recreate the workflow before testing the credential independently. | A production execution using the credential succeeds on the same node. |
| Credentials type is not known | Custom/community node package is missing on one runtime or after upgrade. | Compare installed node packages and n8n version across main and worker containers. | Do not import workflows into production until the credential type exists there. | The credential type appears in the UI and a test execution can load it. |
| OAuth callback reaches n8n but returns 404 or wrong host | Public URL, reverse proxy, or base URL settings are inconsistent with provider settings. | Check WEBHOOK_URL/public editor URL and proxy forwarded host/proto headers. | Do not add multiple provider redirect URIs before proving which URL n8n actually emits. | The callback uses the public HTTPS domain and lands on the credential completion screen. |
| Provider accepts callback but API calls return 403 | OAuth scopes are insufficient or the app was approved with old permissions. | Compare requested scopes with the API action the node is trying to perform. | Do not store broader scopes than needed without documenting the reason. | A minimal API action using the same credential succeeds with the required scope. |
Still blocked after these checks?
Use the brief to decide whether to keep fixing this setup, move the workload to n8n Cloud, or rebuild the self-hosted path on cleaner infrastructure.
Recommended Steps
- Open the failing n8n credential and copy the OAuth redirect or callback URL shown by n8n.
- Paste that exact URL into the provider's OAuth app settings.
- Confirm the public domain, HTTPS, and reverse proxy route reach the n8n instance.
- Check required scopes and whether the provider expects a single-service or generic OAuth credential.
- Reconnect the credential from n8n and test a low-risk read operation.
Verification
- The OAuth provider accepts the exact n8n callback URL.
- The browser returns to n8n after authorization.
- The credential test or a low-risk node operation succeeds.
- The callback URL uses the intended public HTTPS domain.
Warnings
- Do not manually guess the callback URL when n8n displays one in the credential setup.
- Changing public domain or proxy settings can break existing OAuth credentials.
- A successful OAuth login can still fail later if scopes are missing for the node operation.
Common Mistakes
- Using localhost in a provider OAuth app for a public self-hosted instance.
- Copying only the domain and not the full callback path.
- Missing required scopes for the selected node operation.
- Changing WEBHOOK_URL or public domain after creating credentials.
Examples
n8n displayed callback URL: copied exactly
Provider app redirect URI: exact match
Public domain uses HTTPS: yes
Reverse proxy reaches n8n: yes
Scopes cover operation: yes
Credential reconnect succeeds: yesredirect_uri_mismatch -> compare the full callback URL, including path and protocol
invalid_client -> check client ID, secret, app status, and environment
access_denied -> check user consent and account permissions
insufficient_scope -> add required scopes, reconnect, and retest the node operationPublic editor URL loads over HTTPS: yes
n8n generated callback URL uses the public domain: yes
Provider app stores that exact URL: yes
Reverse proxy forwards callback path to n8n: yes
Old credentials reconnected after URL change: yesFAQ
Why does OAuth work on n8n Cloud but not self-hosted?
Self-hosted instances must expose a correct public HTTPS URL and configure the provider app with the exact callback URL.
Is this a credential password problem?
Usually no. OAuth callback errors are more often redirect URL, domain, proxy, or scope configuration problems.