Document redirect URI matching rules and the loopback port exception

[coyotte508]

The OAuth authorization endpoint now accepts any port for http loopback redirect URIs (RFC 8252 §7.3 / OAuth 2.1), so native apps, CLIs and MCP clients can register a port-less http://localhost/callback and bind an ephemeral port at request time. Everything else still requires an exact match.

Doc page

---

Note

Low Risk
Documentation-only changes with no runtime or security behavior modifications in this diff.

Overview
Documents how Hugging Face Hub OAuth treats redirect_uri on authorization requests: it must exactly match a registered redirect URI, with one exception for HTTP loopback URIs per RFC 8252 §7.3 / OAuth 2.1.

Adds a Redirect URIs section explaining that apps can register port-less loopback callbacks (e.g. http://localhost/callback) and use whatever ephemeral port the OS assigns at request time. It also clarifies limits: the port exception applies only to http on localhost / 127.0.0.1 / [::1]; https and custom schemes still need exact matches; loopback hostnames are not interchangeable; only the port may differ (path, query, userinfo must match).

Updates the CIMD / automated OAuth app section with an example of listing port-less loopback URIs in redirect_uris for native apps and MCP clients, with a link to the new section.

^{Reviewed by Cursor Bugbot for commit 767cd10. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.