oauth

OAuth providers validate redirect URIs against domain rules. .localhost subdomains fail on most providers because they are not in the Public Suffix List or are explicitly blocked. Portless fixes this with --tld to serve apps on real, valid domains. When portless uses the default .localhost TLD, OAuth providers reject redirect URIs like : Google and Apple are the strictest. Microsoft and GitHub are more lenient with localhost. Use a valid TLD so the redirect URI passes provider validation: Any TLD in the Public Suffix List works: .dev , .app , .com , .io , etc. Bare TLDs like .dev mean myapp.dev could collide with a real domain. Use a subdomain of a domain you control: This ensures no outbound traffic reaches something you don't own. For teams, set a wildcard DNS record ( *.local.yourcompany.dev -> 127.0.0.1 ) so every developer gets resolution without /etc/hosts .