OAuth Callback on Localhost
The problem
OAuth providers (Google, GitHub, Auth0, etc.) require HTTPS redirect URIs. http://localhost:3000/callback works with some providers in development mode, but many require a publicly reachable HTTPS URL for testing production-like flows.
Solution: tunnel + redirect URI
npx localtolink --port 3000
Register this redirect URI in your OAuth provider:
https://k7m2x9p4q1.localtolink.com/auth/callback
Use the exact subdomain LocalToLink prints — it changes on each new session.
Redirect URI rules
- Must match exactly — scheme, host, path, and trailing slash
- Most providers allow multiple redirect URIs — add both localhost and tunnel URLs during dev
- Some providers restrict wildcards — you cannot use
*.localtolink.com; register each subdomain individually
Browser interstitial warning
When you open the OAuth flow in a browser, visitors (including you) may see LocalToLink's one-time warning page before reaching your app. After clicking through, a cookie bypasses it for 24 hours on that subdomain.
For automated OAuth testing in headless browsers, this is usually fine — click through once per subdomain.
API-based token exchange (server-side) is not affected by the interstitial.
Provider-specific tips
Google OAuth
Add the tunnel URL under Authorized redirect URIs in Google Cloud Console → APIs & Services → Credentials.
GitHub OAuth App
Set Authorization callback URL to your tunnel URL in GitHub → Settings → Developer settings → OAuth Apps.
Auth0
Add the tunnel URL to Allowed Callback URLs in your Auth0 application settings.
Limitations (v1.0)
- Random subdomain per session — update provider settings when you restart the tunnel (custom subdomains in v1.5)
- 2-hour session limit — restart tunnel and update redirect URI for longer sessions
- No persistent URL — new session = new subdomain after reconnect grace expires
For n8n OAuth specifically, see n8n OAuth and Webhooks on Localhost.
Try it now
Start a tunnel from your project directory — no account required.
$ npx localtolink