How do I use a localhost redirect URI for OAuth testing in a Stripe app?

When using OAuth with your Stripe app, there are two different contexts to consider:

1. Testing with the OAuth Test Mode link:
   The documentation lets you use a localhost URL (an insecure HTTP URL) when you’re testing in Test mode. This is why your test mode link with

   redirect_uri=http://localhost:3000/api/stripe/install
   

   appears to work in that context.

2. Publishing your app (via manifest file):
   When you publish your app, however, Stripe requires that all redirect URIs in the manifest (stripe-app.json) be HTTPS. This is why you see the error:

   "expect valid HTTPS URI. got http://localhost:3000/api/stripe/install"
   

   The published manifest must use secure (HTTPS) endpoints.

How to Solve This

• For Development:
  Continue using your HTTP localhost outlet in your test mode link. This is allowed solely for testing purposes.

• For Publishing:
  You need to provide an HTTPS redirect URI. Developers typically use one of the following approaches:

  • Move your endpoint to a staging/production server that has a valid HTTPS certificate.
  • Use a tunneling tool (like ngrok) which provides an HTTPS endpoint that maps to your localhost server.

This separation ensures that while you can test with a non-secure localhost URL, any publicly published version of your app meets Stripe’s security requirements with HTTPS.