Skip to main content
Solved

Best practice for OAuth Redirect URIs with dynamic mapps code:push URLs?

  • January 9, 2026
  • 3 replies
  • 53 views

Hi everyone,

I am building a React + Express app and deploying it using the Monday CLI (mapps code:push).

I am currently implementing the OAuth flow, but I am stuck in a tedious manual loop regarding the Redirect URI.

The Scenario:

  1. Frontend: I initiate the OAuth flow using window.location.origin to build the redirect URI dynamically.

  2. Backend: In my callback function, I use an environment variable (MONDAY_VERSION_URL) to validate the redirect_uri during the token exchange.

The Code:

Frontend (Initiating Auth):

JavaScript

 

const startOAuth = async () => {
const { data: context } = await monday.get("context");
const currentOrigin = window.location.origin; // This changes on every deploy
const redirectUri = `${currentOrigin}/oauth/callback`;

const authUrl = `https://auth.monday.com/oauth2/authorize?client_id=${
context.app.clientId
}&redirect_uri=${encodeURIComponent(redirectUri)}`;

monday.execute("openLinkInTab", { url: authUrl });
};

Backend (Callback):

TypeScript

 

export async function oauthCallback(req: Request, res: Response) {
// ... check code ...

// I have to manually update this Env Var after every push
const currentRedirectUri = envManager.get("MONDAY_VERSION_URL");

const response = await fetch("https://auth.monday.com/oauth2/token", {
// ...
body: new URLSearchParams({
// ...
redirect_uri: `${currentRedirectUri}/oauth/callback`,
}),
});

// ... save token ...
}

The Problem: Every time I run mapps code:push, Monday generates a new unique Version URL (e.g., https://random-uuid-v1.monday.app).

This forces me to do the following steps every single time I deploy a change:

  1. Run mapps code:push.

  2. Copy the new Version URL.

  3. Go to Monday App Management -> OAuth and add this new URL to the Redirect URIs list.

  4. Update my MONDAY_VERSION_URL environment variable in the code/server.

My Question: Is there a standard way to handle this workflow?

  • Is there a way to use a "fixed" URL for the Redirect URI even when deploying new versions?

  • Or should I be handling the redirect_uri logic differently so I don't have to update the App Settings and Env Vars on every push?

Any advice on how to streamline this deployment process would be appreciated!

Best answer by mitchell.hudson

@emrekaraduman 

 

monday code provides you with a live URL that won’t change - https://developer.monday.com/apps/docs/manage-monday-code-in-the-developer-center

 

You can use this URl for all of your deployments (note, you will get a different URL per region if you are enabling multi region support so you will need to handle that situation)

 

If you are testing the flow in local development, you can default to an env value or something if needed as well.

3 replies

mitchell.hudson
  • Community Expert
  • Answer
  • January 12, 2026

@emrekaraduman 

 

monday code provides you with a live URL that won’t change - https://developer.monday.com/apps/docs/manage-monday-code-in-the-developer-center

 

You can use this URl for all of your deployments (note, you will get a different URL per region if you are enabling multi region support so you will need to handle that situation)

 

If you are testing the flow in local development, you can default to an env value or something if needed as well.


dvdsmpsn
Forum|alt.badge.img+1
  • Participating Frequently
  • January 14, 2026

100% what ​@mitchell.hudson said.

If you are on a version origin, redirect to the static live origin. Use something like this on the authorise page:
 

if (staticOrigin !== location.origin) {
window.location.replace(
`${staticOrigin}${location.pathname}${location.search}`
);
} else {
// carry on as normal
window.location.replace(redirectUrl);
}

 


  • Author
  • Participating Frequently
  • January 15, 2026

Thanks a lot ​@mitchell.hudson   and ​@dvdsmpsn 🙌
That makes perfect sense now. I didn’t realize the live URL was stable across deployments.
Using the static origin and redirecting from the version URL solves my problem cleanly.
Really appreciate the clear explanation and example!