---
title: "Allowlist a hosted sign-in return destination"
method: POST
path: "/v1/auth/sign-in/return-destinations"
tags: ["Auth"]
---

# Allowlist a hosted sign-in return destination

`POST /v1/auth/sign-in/return-destinations`

## Request

- Base URL: `https://api.configure.dev`
- URL: `https://api.configure.dev/v1/auth/sign-in/return-destinations`
- Auth: API key in header `X-API-Key`

Adds a web callback or native deep link that can receive short-lived hosted sign-in codes.

## Headers

- `X-Agent` string

## Request body

- SignInReturnDestinationRequest
  - `return_to` string, required: Absolute web callback URL or native deep link. URL fragments are stripped before storage.

## Response `201`

Return destination allowlisted.

- SignInReturnDestination
  - `destination` string, required
  - `created_at` string, date-time

## Other responses

- `400`: Request shape is invalid.
- `403`: Forbidden. Common causes include secret_key_required, token_wrong_type, approval_required, or access_denied.

---

[API](https://skmtc.dev/configure/apis/configure-http-api.md) · [All operations](https://skmtc.dev/configure/apis/configure-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/configure/apis/configure-http-api/revisions/ec760a9533d2?raw)