Managing allowed callback urls for multiple subdomins

[gabor.ottlik.hun]

What is the best practice to manage login to one of my many subdomains. One subdomain represent a website a user can create on the fly by clicking on various templates. Many subdomain can belongs to one user.

I’m particulary interested in how to manage Allowed callback urls because now I use a Management API to dynamically create callback url for each created subdomain.
I’m thinking there must be a better way to manage these url records.
I’m not so familiar with organisations but I would like to use something like Organization URL placeholders but as i read it’s more for custoemrs not for customers’ individual websites.
It’s a but cumbersome to manage these callback urls, because any acsidental deletaion could lead to a website be unavailable. The fiels also tiny/short to observe the available callbacks.

Any guidance would be appreciated.

[vlad.murarasu]

Hi @gabor.ottlik.hun,

Typically, you should only keep authentication for the main subdomains. User-generated subdomains should not use authentication, as Google Sites does. You can technically use Wildcard URL placeholders, but not in production, since they pose a security threat. Make the user-generated subdomains accessible without authentication.

If you have any other questions, feel free to reach out.

Have a good one,
Vlad