OAuth redirect security review cost for the callback

OAuth redirect security review cost is $2,400 once for one app whose login sends the browser back to a callback URL. $1,200 starts the work. The report is due 48 hours after a test user can finish that login. You own the PDF. There is no subscription.

The identity provider issues the code. Your callback is the address that code is allowed to land on. A loose return address is the thing I am paid to look at.

Short answer: OAuth redirect security review cost is $2,400 once, with $1,200 to start, for one app. I check the callback URL the login returns to, whether that return matches the registered list, and whether a page on your app forwards the browser somewhere else. The report lands 48 hours after access works. You own it. The offer is the web application security review.

What does an OAuth redirect security review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying an identity-provider seat, a scanner subscription, or a stamp I do not hold.

Synack’s 2026 cost post puts a typical web application test at $5,000 to $30,000. Blaze Information Security’s 2026 table prices a complex SaaS app, including SSO and OAuth, at $20,000 to $30,000+, over two to three weeks. That is a different calendar and a different deliverable.

What you are buying	2026 price	What you actually get
Mostly automated scan	Often under $3,000	Tool output. Thin judgment on the callback
This redirect review	$2,400 once, $1,200 to start	One app, the callback, the registered return list, the report in 48 hours, one retest
Complex SaaS test with OAuth	$20,000–$30,000+	Multi-week scope: tenants, payments, SSO, and the API
Typical web app test	$5,000–$30,000	Longer engagement, often written for a compliance packet

Three passes, a year apart, are $7,200. One $20,000 complex SaaS quote is a different product. The same $2,400 is on security review pricing.

What does the $2,400 check on the callback?#

I sign in on the URL you authorize and record where the browser is sent back. The bar is an exact return address, a callback that does not forward the browser onward, and a code that only your app can finish.

RFC 6749 says the redirection endpoint must be an absolute URI and must not include a fragment. When the full URI was registered, the authorization server must compare the two with simple string comparison. On the token request, a redirect URI sent at the start must come back identical.

RFC 9700 requires exact string matching, except for port numbers on localhost redirects for native apps. Clients and authorization servers must not expose a URL that forwards the browser to an arbitrary address from a query parameter. The client must also stop a cross-site request on the callback: PKCE when the server supports it, the OpenID nonce on those flows, or a one-time state value bound to the browser.

On this pass I record:

• Whether the return address your app uses is the one you say is registered, character for character, including the path.
• Whether a wildcard, a prefix, or a partial path is doing the job of an exact URI.
• Whether the callback, or a page it reaches, forwards the browser to an address supplied in the request.
• Whether the token call repeats the same redirect URI that started the login.
• Whether PKCE or a one-time state value is actually on that callback.

The document shape is the sample pentest report. No client names. A broader login, reset, and session pass is a different cut, covered in the authentication security review.

What is not included for $2,400?#

You get severity, the callback path, the role, and a fix an engineer can ticket, for one authorized app. I do not rewrite the identity-provider dashboard, ship exploit steps, test a second client, or hand you a certificate I do not hold.

An Auth0, Clerk, WorkOS, or Stytch tenant bill is their product. This price does not include tenant admin, a Management API token, or a settings rewrite inside their console. I do not need the client secret. If the secret is in the browser bundle, I name the path. I do not print the secret.

A second web origin or a mobile client is a second quote. I do not patch production inside this price.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not inspect a callback URL.

How does the review run from access to the PDF?#

You authorize one URL, I finish login with the test user you send, and the clock starts when that login works. The PDF is what you keep. I do not change the registered redirect list for you.

Step	What happens
Trigger	A buyer asked how the callback is locked, or you added a new return URL
Action	I complete login and compare the return address to the list you pasted
System of record	The running app, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization, one working test user, and the redirect URIs you believe production registered. Say whether PKCE is on. Name any page that is supposed to stay public. One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Pay the $1,200 when I can legally open the app and a test user can finish login. A named certificate this offer does not include is a different firm. A callback that does not exist yet is a missing page.

Wait until someone can complete login today, and until the return address is a URL I can reach. Hire the firm that holds CREST if the questionnaire requires that name. If the question is only which audience an Auth0 API should accept, that is a tenant review, not this callback pass. The same web application security review still covers auth and the API when the login is not OAuth.

What should be true before I start?#

Bring the URL, a test user who can finish login, and the exact return addresses you believe are registered. I can start without identity-provider admin. I cannot start from a screenshot of a dashboard.

Before you pay, write which callback production uses, which extra URIs are registered for staging, and whether a query parameter on your site is allowed to send the browser somewhere else. If two roles must not share a session after login, say so.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.