OAuth - Invalid redirect_uri

[Brianelvio]

Describe the bug When using @atproto/oauth-client with a loopback client configuration, the authorization request fails with "Invalid redirect_uri" error even when following the documented format.

To Reproduce Steps to reproduce the behavior:

1. Configure OAuthClient with loopback client settings
2. Set client_id to 'http://localhost'
3. Set redirect_uri to 'http://127.0.0.1:3000/api/socials/bluesky/callback'
4. Call client.authorize()
5. Receive 400 error with "Invalid redirect_uri" message

Expected behavior The authorization request should succeed since we're using the documented loopback client configuration with localhost/127.0.0.1.

Details

• Operating system: Any
• Node version: 18+
• @atproto/oauth-client version: latest

Additional context The error occurs even when following the documentation for loopback clients. It seems the redirect_uri validation may be stricter than documented or there may be a mismatch between allowed redirect URI formats for loopback clients.

Client Metadata

clientMetadata: {
      client_id: 'http://localhost',
      redirect_uris: ['http://127.0.0.1:3000/api/socials/bluesky/callback'], // Changed from 127.0.0.1
      grant_types: ['authorization_code', 'refresh_token'],
      response_types: ['code'],
      token_endpoint_auth_method: 'none',
      application_type: 'native',
      scope: 'atproto'
    },

Error message: 400 OAuth "invalid_request" error: Invalid redirect_uri [http://127.0.0.1:3000/api/socials/bluesky/callback]

[prenaissance]

Is "http://127.0.0.1:3000/api/socials/bluesky/callback" in the client metadata redirect_uris field?

[Brianelvio]

Is "http://127.0.0.1:3000/api/socials/bluesky/callback" in the client metadata redirect_uris field?

Hey, yeah sorry let me add my client metadata:

clientMetadata: {
      client_id: 'http://localhost',
      redirect_uris: ['http://127.0.0.1:3000/api/socials/bluesky/callback'], // Changed from 127.0.0.1
      grant_types: ['authorization_code', 'refresh_token'],
      response_types: ['code'],
      token_endpoint_auth_method: 'none',
      application_type: 'native',
      scope: 'atproto'
    },