Is there a reason the Foursquare API v2 doesn’t support multiple callback URLs for a consumer? It’s a big hindrance on dev ops to have to define a brand new application for every single test environment. AFAIK, no other major networks constrain app redirects to this extent.
Is there a rationale for this limitation? I get the risks of open redirects, and domain-only matches seems to be ruled out by the latest OAuth 2.0 draft spec, but multiple endpoints seem to be totally Kosher (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-23#section-3.1.2.2).
No real reason — multiple callback URLs was added to the OAuth 2 spec relatively recently and support for it has not been added yet.