The list of allowed callback URLs for the Application. When a user completes authentication on the hosted login screen, they are redirected back to the app that prompted the authentication. Because the callback URL can be tampered with, as a security measure, Oystehr only redirects to callback URLs which are listed here. allowedCallbackUrls may be an empty array.

The list of allowed logout URLs for the Application. After a logout is completed, a user will be redirected to a URL specified with the logout request. Because the logout redirect URL can be tampered with, as a security measure, Oystehr only redirects to logout redirect URLs which are listed here. allowedLogoutUrls may be an empty array.

The list of allowed web origins URLs for the Application. Any domain that needs to be able to initiate a login must be listed here. These URLs must not include any path or query strings (e.g. 'https://docs.oystehr.com'). An asterisk may be used as a wildcard placeholder for subdomains (e.g. https://*.oystehr.com). allowedWebOriginsUrls may be an empty array.

The allowed CORS origins urls for the Application. Any domain that needs to be able to make requests from browser JavaScript to our identity provider APIs must be listed here. These URLs must not include any path or query strings (e.g. 'https://docs.oystehr.com'). By default, all domains from allowedCallbackUrls are allowed. allowedCORSOriginsUrls may be an empty array.