Hi @jthibeaux,
Welcome to the Auth0 Community !
Your understanding is correct, you must specify the different subdomains in your callback URLs as mentioned in our documentation on the matter - Subdomain URL Placeholders, but also stated by this knowledge article - Dynamic Callback URLs with Wildcards
- A placeholder must not be used in conjunction with a wildcard in the URL.
https://{organization_name}.*.exampleco.com
will not work.
However you can keep the {organization_name} placeholder in order to have an exact match when it comes to the Callback URL list, but you can deny access to any user that is trying to authenticate to that specific organization from the server-side, after inspecting the token and comparing the org_id claim to the id of the intended organization for the current subdomain.
I’m sorry for the late reply, but I hope this helps your use and others as well!
Thanks,
Remus