feature request: Support multiple admin console redirect URIs or secondary ADMIN_ENDPOINT for VPN/private network access

[stevenemrick-gmail]

What problem did you meet?

I run a self-hosted Logto OSS instance with
ADMIN_ENDPOINT set to a public-facing domain
(e.g. https://auth-admin.example.com) behind
a CDN for caching and DDoS protection.

I want to access the admin console from a
private VPN network using a
VPN-only hostname without exposing my
server's IP address.

The problem:
The admin console SPA constructs redirect_uri
from window.location.origin. When accessed via
the VPN URL, the browser sends:
redirect_uri = https://vpn-hostname/console/callback

Logto's OIDC server only accepts redirect URIs
derived from ADMIN_ENDPOINT, so the OIDC
validation fails with oidc.invalid_redirect_uri.

Header rewriting (nginx X-Forwarded-Host) does
not help because redirect_uri is constructed
client-side from window.location.origin, not
from server headers.

What I tried:

• nginx proxy with Host/X-Forwarded-Host rewriting
• Tailscale sidecar with TS_SERVE_CONFIG
• Management API (admin-console app not exposed)
• Related issues: bug: redirect_uri did not match any of the client's registered redirect_uris when using Cloudflare Tunnel #6648 (Cloudflare Tunnel),
  Discussion How to access admin console when it's inside of a container? #6476

What would solve this:
Option A: Environment variable for additional
allowed redirect URIs:
ADMIN_EXTRA_REDIRECT_URIS=https://vpn-hostname

Option B: Make the admin-console app patchable
via Management API so redirect URIs can be
added directly

Option C: Support for multiple ADMIN_ENDPOINT
values (comma-separated)

Thank you for your great product and consideration !

Describe what you'd like Logto to have

I want to access the admin console from a
private VPN network using a
VPN-only hostname while behind
a CDN for caching and DDoS protection.

[wangsijie]

Host rewriting can't work here: the console derives its endpoint from window.location.origin, so discovery returns an issuer pointing at ADMIN_ENDPOINT. Rewriting the issuer isn't an option — iss is a signed identity claim.

Use split-horizon DNS instead: resolve auth-admin.example.com to the internal IP inside the VPN, to the CDN publicly. Origin, issuer, and redirect_uri then agree, no config change needed.

We don't plan to support multiple admin endpoints, since the origin determines the OIDC issuer.