> For the complete documentation index, see [llms.txt](https://docs.tryterra.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tryterra.co/faq/help-topics/connecting/oauth-webview-and-sign-in-failures/verify-redirect-legitimacy.md).

# How do I verify auth redirect URLs are legitimate?

Auth redirects **do not carry a signed header** like webhooks do. Verify legitimacy by checking the `user_id`, `reference_id` and `resource` parameters in the redirect URL against the values from your original widget session request.

Best practice:

* Do the validation **server-side**.
* **Store the expected redirect URLs** when generating the session.
* Always use **HTTPS** redirect URLs.

See [handling authentication events](https://docs.tryterra.co/health-and-fitness-api/user-authentication/handling-authentication-events).