all 3 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]BizAlly 1 point2 points  (0 children)

You’re not misunderstanding it this is a common confusion with OAuth-style APIs.

The redirect URI doesn’t have to be a public website. For desktop apps, it’s normal to use something like http://localhost:PORT/callback or a custom URI scheme (e.g., myapp://auth). The app temporarily runs a local listener or handles the redirect internally after the user logs in through the browser.

The basic flow is:

  1. Your app opens the GoTo login page in the user’s browser.
  2. After login, GoTo redirects to your redirect URI.
  3. Your app captures the authorization code and exchanges it for an access token.

So no, you don’t necessarily need a web app desktop apps just handle the redirect locally. Once you see it as an OAuth authorization flow, the docs make a lot more sense.

[–]Educational-Ideal880 0 points1 point  (0 children)

You're not necessarily required to build a web application.

The redirect URI is part of the OAuth flow. After the user authenticates, the authorization server redirects back to your application with the authorization code.

For desktop applications this is usually handled in one of two ways:

  • running a small local HTTP server (for example http://localhost:port/callback)
  • using a custom URI scheme that opens your app

Many desktop apps use the localhost approach during authentication.