Diagnosing Facebook Login Redirect URI Mismatches – A Step‑by‑Step Guide

Problem Statement

When users attempt to log in with Facebook, a common failure is an OAuthException indicating a redirect URI mismatch. The error usually appears as a popup or a console message with code 102 or 400. This guide helps you identify the exact cause, run targeted checks, apply the correct fixes, and know when to involve Facebook support.

Root Cause & Diagnostic Table

Condition	Root Cause	Diagnostic Check	Fix
OAuthException 102 (redirect_uri mismatch)	Redirect URI in request differs from registered URI	Verify redirect_uri value in the login URL	Update request to match the exact registered URI
OAuthException 400 (invalid_request)	Missing or wrong App ID/Secret in the request	Check query parameters and server‑side code	Ensure App ID is present and App Secret is used only server‑side
Login blocked for non‑test users	App remains in development mode	Review App Mode in the Facebook Developer Dashboard	Switch to Live mode or add users to the Testers list
Browser rejects redirect	TLS certificate validation fails	Inspect browser console for SSL errors	Use a valid, trusted certificate and correct domain

Ordered Diagnostic Checklist

1. Capture the error
   • Open the browser console (F12) and note the error code and message.
   • Look for OAuthException with code 102 or 400.
2. Verify the redirect URI in the login request

   https://www.facebook.com/v18.0/dialog/oauth?client_id=YOUR_APP_ID&redirect_uri=https%3A%2F%2Fyourapp.com%2Fauth%2Ffacebook&state=XYZ

   • Ensure the redirect_uri value is URL‑encoded and matches exactly one of the URIs listed under Settings → Advanced → Valid OAuth Redirect URIs.
   • Case sensitivity matters – https://yourapp.com/auth/facebook is different from https://yourapp.com/auth/Facebook.
3. Check App ID and Secret usage
   • In server‑side code, confirm the App ID is passed correctly.
   • Never embed the App Secret in client‑side JavaScript; use it only on the server when exchanging the code for an access token.
4. Confirm App Mode
   • Navigate to the Facebook Developer Dashboard → App Settings → App Mode.
   • If the app is in Development mode, only users added as Testers, Developers, or Admins can authenticate. Add the user to the Testers list or switch to Live mode after passing the App Review.
5. Validate TLS configuration
   • Open the redirect URI in a browser. If you see a security warning, the certificate is invalid or the domain is not covered.
   • Use a tool like openssl s_client -connect yourapp.com:443 to inspect the certificate chain.
6. Test with Graph API Explorer
   • Navigate to Graph API Explorer.
   • Choose your app, set the redirect_uri to the same value, and click Get Access Token. Success indicates the URI is accepted by Facebook.
7. Inspect server logs
   • Look for OAuthException messages or TLS handshake failures that match the error code.
   • Confirm that the server is using the correct App Secret when exchanging the code.

Fixes Tied to Findings

• Mismatch in redirect URI – Update the login URL or add the exact URI to the App Settings.
• Missing or wrong App credentials – Add the App ID to the query string; keep the App Secret server‑side.
• Development mode blocking users – Add the user to Testers or switch to Live mode.
• TLS validation failure – Deploy a valid SSL certificate for the redirect domain.

Escalation Criteria

1. If all checks above pass but the error persists, the problem may lie in Facebook’s backend or an App Review restriction. Open a support ticket via the Developer Dashboard.
2. When the App is in Live mode and users still see the error, verify that the App Review has approved all requested permissions and that the App ID is correctly configured for the production environment.
3. For TLS issues that cannot be resolved locally (e.g., certificate chain problems), contact your hosting provider or SSL vendor.

Limitations & Practical Check

This guide assumes you are using the standard OAuth flow for Facebook Login and that you have access to the Developer Dashboard. It does not cover custom authentication backends or third‑party SDKs that may alter the redirect flow. After applying fixes, perform a fresh login attempt and confirm the console shows no OAuthException codes. Use a tool like curl -I https://yourapp.com/auth/facebook to ensure the server responds with a 302 redirect to Facebook and that the Location header contains the correct redirect_uri.