# What is Callback URL?

Also called Redirect URI, Return URL.

A callback URL is an address that one system gives another so the second system can direct a browser or a request back to it once something finishes. It appears in authorization flows as the redirect target after a user approves access, and in asynchronous APIs as the endpoint that receives a result when a long running job completes.

In an authorization flow, the client registers one or more exact callback URLs with the provider in advance. When the user approves, the provider redirects the browser to that address with a short lived code or error attached. The provider must match the requested URL against the registered list, because an unvalidated redirect target would let an attacker capture the code by pointing the flow at their own server.

In asynchronous processing, a callback URL serves the same purpose as a webhook destination but is supplied per request rather than configured once. A caller submits a job and includes the address to notify. This suits work whose duration is unpredictable, since neither side must hold a connection open, and different jobs may report to different destinations.

A callback endpoint is publicly reachable by definition, so it must assume hostile traffic. Verifying a signature, checking a shared secret, and confirming that the payload corresponds to a job the receiver actually started are all standard. Treating the callback body as a notification and then fetching authoritative data over an authenticated channel is a common defensive pattern.

Practical friction is mostly in development and in strict matching. Local machines are not reachable from the public internet without a tunnel, and providers usually compare the registered and requested URLs exactly, so a trailing slash, a different port, or an http rather than https scheme will cause a mismatch error.

## Key points

- Address a system returns to after a flow or job finishes
- Authorization providers match it exactly against a registered list
- Per request variant of a configured webhook destination
- Endpoint is public, so verify signatures and expected jobs
- Local development usually needs a tunnel

## In practice

An application starts an authorization flow and requests the callback https://app.example.com/auth/return. After the user consents, the provider redirects the browser there with a one-time code. The application exchanges that code for tokens over a direct server to server call. Because the provider only permits callbacks it has on file, a request naming a different host is rejected before any code is issued.

## Related terms

- [OAuth](/en/glossary/oauth)
- [Webhook](/en/glossary/webhook)
- [API](/en/glossary/api)
- [Bearer Token](/en/glossary/bearer-token)
- [HMAC Signature](/en/glossary/hmac-signature)

[Back to the AI Glossary](/en/glossary)