title: How can I specify localhost loopback redirect_uri for Native application for Microsoft OAuth2 provider?
body: <p>I have the code which authorizes at <a href="https://login.live.com/oauth20_authorize.srf" rel="nofollow noreferrer">https://login.live.com/oauth20_authorize.srf</a> endpoint.</p>
  
  <p>Parameters of the call: "client_id=" + ClientID + "&amp;scope=" + someScopes + "&amp;response_type=code&amp;redirect_uri=" +  WebUtility.UrlEncode("<a href="http://localhost:some-port/signin-microsoft" rel="nofollow noreferrer">http://localhost:some-port/signin-microsoft</a>")</p>
  
  <p><a href="http://localhost:port/signin-microsoft" rel="nofollow noreferrer">http://localhost:port/signin-microsoft</a> is registered as one of Redirect URLs in my app at <a href="https://apps.dev.microsoft.com" rel="nofollow noreferrer">https://apps.dev.microsoft.com</a> (I had to use Add Platform -> Web to put this redirect_url there).</p>
  
  <p>I run HttpListener (local web server in the app) to intercept the authorization code. Then I get the code and pass it to this endpoint:</p>
  
  <p><a href="https://login.live.com/oauth20_token.srf" rel="nofollow noreferrer">https://login.live.com/oauth20_token.srf</a></p>
  
  <p>Parameters of the call: "client_id=" + ClientID + "&amp;code=" + code + "&amp;grant_type=authorization_code&amp;redirect_uri=" + WebUtility.UrlEncode("<a href="http://localhost:some-port/signin-microsoft" rel="nofollow noreferrer">http://localhost:some-port/signin-microsoft</a>")</p>
  
  <p>This fails because ClientSecret is missing. If I add ClientSecret, it works and I get the access and refresh token.</p>
  
  <p>However, native apps should not store and send OAuth2 client secrets. ClientSecret is required for web apps only.</p>
  
  <p>Now's the problem. apps.dev.microsoft.com portal does not let me specify localhost redirect_uri for Native apps. I can do this for web apps only (in Web / Redirect URLs section). With Native apps, trying to specify any URI always results in "Your URI must be in the format of {scheme}://{domain}/{path}, have no query string parameters, and be limited to 255 characters." message.</p>
  
  <p>I seems that only a few predefined values are allowed there (such as <a href="https://login.live.com/oauth20_desktop.srf" rel="nofollow noreferrer">https://login.live.com/oauth20_desktop.srf</a>). Even if I add or change any single char in this value, it's no longer valid and the portal does not let me save the changes. I can these predefined values only if I don't have localhost-based redirect_uri. This means I have to use the complex methods of obtaining the authorization code (monitoring browser processes and so on) instead of a simple HttpListener (which is used by Google OAuth2 provider, for instance).</p>
  
  <p>Is there a way to use localhost as redirect_uri and still not send ClientSecret, when working with Microsoft OAuth2 provider?</p>
  
  <p>And why can't I specify other URLs in Native Application / Custom Redirect URIs of apps.dev.microsoft.com portal? What's the purpose of this form if I anyway can't add any values except of those predefined ones which are already there?</p>
  
  <p>Again, I have no issues adding my custom URL to Web / Redirect URLs on the same page (and everything's working fine then, it's just that I need to deal with ClientSecret which I don't want to).</p>