Embedded OAuth return
Returning a provider connection to a partner app is unavailable. Connections finish in Mobius for the person who started them.
Returning the browser to your own application after a provider connection is currently unavailable.
Every Gmail, Slack, Outlook, OneDrive, or other OAuth connection now finishes in Mobius, signed in as the person who started it. When the provider sends the browser back, Mobius opens its own finish page and binds the account only if the signed-in person is the one who began the connection. Anyone else sees a message that only that person can finish it.
A connect request that includes return_url is refused with
400 embedded_return_disabled, before the user is sent to the provider.
Remove return_url and client_state from the request and open the
response's redirect_url for a signed-in Mobius user instead.
The organization return-origin allowlist
(/v1/organization/oauth-return-origins) still accepts and returns origins,
but it has no effect while embedded return is disabled.