Does OAuth 2.0 redirect URI validation allow wildcard matching in production?

OAuth 2.0 providers implement strict redirect URI validation to prevent authorization code leakage. While many providers allow http://localhost for local development to simplify testing, production environments strictly mandate HTTPS for all registered endpoints.

A common design challenge arises when managing multiple subdomains or dynamic environments in production. Some implementations attempt to use wildcard patterns in the registered redirect URI whitelist to avoid registering every individual endpoint.

Given the security risks associated with open redirects, there is uncertainty regarding which validation patterns are considered safe or supported across different authorization servers.

• Which specific wildcard patterns, if any, are compliant with current OAuth 2.0 security best practices?
• Does the use of wildcards in a production redirect URI inherently invalidate the security of the authorization code flow?