Can I set for each org one redirect_url?

I have multiple instances, but one of my instances share multiple orgs, and for each of them I want to add a redirect_url, it only works when I set it globally (on default configurations) I need that because I don't want users to loose track of the login page when they go back, I want them to always be redirect to my app page, so they can initialize the login there, and prevent them to access Zitadel Users page after login in

Ask Inkeep•12/11/25, 3:21 AM

Hi @Avlambertucci, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

Ask Inkeep•12/11/25, 3:21 AM

Answer

---

Redirect URIs in ZITADEL are configured at the Application level, not at the Organization level. (1)

Each Application within a Project can have multiple redirect URIs registered, and the requested

redirect_uri

redirect_uri

in your authorization request must match one of those registered URIs. (2) , (1)

To achieve per-org redirect behavior, you have a couple of options:

Create separate Applications per Organization – Each org can have its own Project with its own Application, each configured with the appropriate redirect URI.
Use a single Application with multiple redirect URIs – Register all your org-specific redirect URIs on one Application, then dynamically pass the correct
```
redirect_uri
```
```
redirect_uri
```
in your authorization request based on which org the user belongs to. (2) , (1)
Trigger org context via scopes – You can send the organization id (
```
urn:zitadel:iam:org:id:{id}
```
```
urn:zitadel:iam:org:id:{id}
```
) or primary domain (urn:zitadel:iam:org:domain:primary:{domainname}urn:zitadel:iam:org:domain:primary:{domainname}) scope in your authorization request to trigger org-specific login behavior and branding. (2)

To prevent users from accessing the ZITADEL Console after login, you can configure the default redirect URI and restrict console access. (3)

---

Ask Inkeep•12/11/25, 3:21 AM

To learn more, see the sources I considered:

[1] Authenticate users with OpenID Connect
[2] Configure ZITADEL for your Scenario
[3] Add the possibility to set a custom user profile url

Ask Inkeep•12/11/25, 3:21 AM

Feel free to tag @Ask Inkeep with additional questions.

AvlambertucciOP•12/11/25, 3:37 AM

@Ask Inkeep so all I want to to prevent users to login directly to zitadel therefore I have set my app page to call the login page, but the users sometimes when refreshing a password can go back on the arrow and decide to login from a Zitadel reset password link, I firstly added on default settings a redirect that worked, whenever the user go back it was redirect to the URI i wanted, the problem is that I can use same URI for the instance, I need to do one per Organization or project or application

Ask Inkeep•12/11/25, 3:37 AM

Thanks for the follow-up, @Avlambertucci. I'll get back to you soon.

Ask Inkeep•12/11/25, 3:37 AM

Answer

I wasn't able to find a direct answer for setting per-Organization or per-Application default redirect URIs for the "back" navigation scenario you describe. Here are some relevant sources:

Prevent users from accessing Console (1) :

This discusses the same challenge—password reset emails and the "back" button redirect users to the Console instead of a custom application. The documentation suggests using a reverse proxy to block Console access, but this applies instance-wide rather than per-org.

Configure ZITADEL for your Scenario (2) :

You can use the primary domain scope (urn:zitadel:iam:org:domain:primary:{domainname}urn:zitadel:iam:org:domain:primary:{domainname}) to preselect an organization during login, which may help with branding, but this doesn't address the default redirect URI per-org issue.

Based on the sources, the default redirect URI setting appears to work only at the instance level, and there's an open discussion about this limitation. You may want to click Ask for help to have a team member confirm if per-Organization default redirect URIs are supported or if there's a workaround.

Ask Inkeep•12/11/25, 3:37 AM

To learn more, see the sources I considered:

[1] Prevent users from accessing Console
[2] Configure ZITADEL for your Scenario

Ask Inkeep•12/11/25, 3:37 AM

Feel free to tag @Ask Inkeep with additional questions.

AvlambertucciOP•12/11/25, 4:52 AM

@Ask Inkeep I wish the Default Redirect URI under organization scope could work and redirect the user to whatever is the URI, it only works when I add on default settings (global scrope) does the redirec_URI has to exist in a application or something? order to work on the org scope

Ask Inkeep•12/11/25, 4:52 AM

Thanks for the follow-up, @Avlambertucci. I'll get back to you soon.

Ask Inkeep•12/11/25, 4:52 AM

Answer

---

I wasn't able to find a direct answer on whether the Default Redirect URI at the Organization scope requires the URI to exist in an Application, or why it may not be working at the org level. Here are some relevant sources:

Configure ZITADEL for your Scenario (1) :

Describes registering multiple redirect URIs per Application and using org scopes to trigger org-specific behavior, but doesn't clarify the Default Redirect URI behavior at the org level.

questions-help-bugsRedirect after registration questions-help-bugsRedirect after registration :

A community discussion mentions that instead of setting the Default Redirect URI to your homepage, you should create an endpoint (e.g., /redirect-login/redirect-login) that triggers an authorization request—this way users are redirected properly after login. However, this is a workaround rather than confirmation of per-org Default Redirect URI support.

Based on the available sources, the redirect URIs used during OIDC flows must match those registered on the Application. (3) (1) The Default Redirect URI setting's behavior at the Organization scope versus instance scope isn't explicitly documented in the sources I have.

You may want to click Ask for help to have a team member confirm whether the org-level Default Redirect URI requires the URI to be registered on an Application, or if there's a known limitation.

Ask Inkeep•12/11/25, 4:52 AM

To learn more, see the sources I considered:

[1] Configure ZITADEL for your Scenario
questions-help-bugsRedirect after registration
[3] ZITADEL Applications

Ask Inkeep•12/11/25, 4:52 AM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] Configure ZITADEL for your ...

Ask InkeepAPP•12/11/25, 5:07 AM

Got it. Tagging @Rajat for additional help.