Pyas calendarsZoom refuses every localhost redirect URL, even allow-listed ones
Updated
TL;DR
On October 26, 2026, a standard (server-side) Zoom OAuth app refused every local redirect address we tried, localhost and 127.0.0.1, over http and https, even set as the main redirect URL and on the allow list; the listed-but-refused case came back as error 4700, "Invalid redirect url". Zoom's docs allow loopback redirects only for PKCE or native clients. Develop against an HTTPS address you control, or a tunnel.
What we saw
Most OAuth providers let you register http://localhost:3000/callback while you build, so the sign-in comes back to the app on your laptop. We set up a Zoom OAuth app the same way to test Zoom sign-in locally.
Observed on a Zoom OAuth app's Development credentials, 2026-10-26
With a localhost address on the redirect URL allow list, Zoom refused the authorization with error 4700, "Invalid redirect url". An address not on the list was refused the same way.
We then made the local address the app's main redirect URL as well. Zoom still refused it. We tried localhost and 127.0.0.1, over http and https: every local address was refused.
An HTTPS address on our own domain worked, and Zoom accepted any allow-listed address on the redirect URL's domain, not only its exact host.
Why Zoom does this
Zoom's OAuth docs explain it in a section on loopback redirects: "Loopback redirect is for PKCE-enabled clients or native app clients, not standard confidential OAuth clients." Other apps "must continue to use HTTPS redirect URIs", and even where loopback is allowed, Zoom says "Use 127.0.0.1, not localhost."
A server-side web app that holds a client secret is a confidential client, so it gets no loopback redirect at all. Zoom's app settings page reads differently ("While you can use loopback URLs and other development endpoints for development redirects, avoid using them in production redirects"), which is why so many developers expect it to work. Others have hit the same wall on Zoom's forum, with {"errorCode":4700,"errorMessage":"Invalid redirect url"} on https://localhost:3000/. We did not test PKCE or native clients.
What to do
- Develop against HTTPS. Deploy a development copy to an HTTPS address you control and register that, or run a tunnel to your laptop and register the tunnel's address.
- Use the redirect URL's domain. Zoom matched allow-listed addresses on the main redirect URL's domain, so one domain can carry several development callbacks.
- Leave strict mode off if your callbacks differ in path from the main redirect URL.
- Keep Development and Production apart. Zoom's Development credentials only accept users on your own Zoom account and the testers you add, so they are safe for this.
How Pyas handles it
With Pyas Auth, Zoom redirects to Pyas's own HTTPS callback, never to your app, and PyasConnect then returns the user to your page, which may be http://localhost while you build. A Zoom connection works from an app running on your laptop with no tunnel and no Zoom app of your own. The sandbox also has simulated Zoom accounts, for testing before any real Zoom account connects.