include a redirection URI using the `redirect_uri` request parameter..

Condition: If multiple redirection URIs, only part of a redirection URI, or no redirection URI has been registered.

the client MUST include a redirection URI

use a `redirect_uri` value identical to the value in the authorization request..

Condition: When `redirect_uri` is included in the authorization-code token request.

their values MUST be identical

include `redirect_uri` in the authorization-code token request..

Condition: If `redirect_uri` was included in the authorization request.

redirect_uri REQUIRED, if the "redirect_uri" parameter was included

use the implicit grant or another response type that issues access tokens in the authorization response..

Condition: Unless access-token injection is prevented and the identified token-leakage vectors are mitigated.

clients SHOULD NOT use the implicit grant

use the `code` response type or another response type that causes access tokens to be issued in the token response..

Condition: Instead of using the implicit grant or another response type issuing access tokens in the authorization response.

Clients SHOULD instead use the response type code

include `redirect_uri` in an authorization-code authorization request..

redirect_uri OPTIONAL.

include `redirect_uri` in an implicit-grant authorization request..

redirect_uri OPTIONAL.

automatically redirect the user-agent to the invalid redirection URI..

Condition: If authorization-request validation fails because of a missing, invalid, or mismatching redirection URI.

MUST NOT automatically redirect the user-agent to the invalid redirection URI

ensure that the redirection URI used to obtain an authorization code is identical to the URI supplied when exchanging that code for an access token..

Condition: For the authorization-code grant.

authorization server MUST ensure that the redirection URI ... is identical

require public clients to register their redirection URIs..

authorization server MUST require public clients ... to register their redirection URIs

validate a request-provided redirection URI against the registered value..

Condition: If a redirection URI is provided in the request.

authorization server MUST validate it against the registered value

compare and match the received `redirect_uri` against at least one registered redirection URI or registered URI component..

Condition: When `redirect_uri` is included in an authorization request and redirection URIs were registered.

authorization server MUST compare and match the value received

compare the two URIs using simple string comparison..

Condition: If client registration included the full redirection URI.

authorization server MUST compare the two URIs using simple string comparison

ensure that `redirect_uri` is present in the authorization-code token request..

Condition: If `redirect_uri` was included in the initial authorization request.

The authorization server MUST: ensure that the "redirect_uri" parameter is present

ensure that the token-request `redirect_uri` is identical to the value from the initial authorization request..

Condition: If `redirect_uri` is included in the authorization-code token request.

The authorization server MUST: if included ensure that their values are identical

verify that the URI to which it will redirect the access token matches a redirection URI registered by the client..

Condition: When processing an implicit-grant authorization request.

authorization server MUST verify that the redirection URI ... matches a redirection URI registered by the client

ensure that the requested and registered redirection URIs are equal using simple string comparison..

Condition: Except for native applications using a localhost URI.

authorization server MUST ensure that the two URIs are equal

allow variable port numbers..

Condition: For native applications using a localhost redirection URI.

authorization server MUST allow variable port numbers

require confidential clients to register their redirection URIs..

authorization server ... SHOULD require confidential clients to register their redirection URIs

inform the resource owner of the error..

Condition: If authorization-request validation fails because of a missing, invalid, or mismatching redirection URI.

authorization server SHOULD inform the resource owner of the error

trust the redirection URI without further checks..

Condition: If the origin and integrity of the authorization request containing it can be verified.

authorization server MAY trust the redirection URI without further checks