Sign in with AWS IAM Identity Center redirects to localhost:3128 instead of production callback URL

[chleiva]

Before opening, please confirm:

• I have searched for duplicate or closed issues

Operating System

N/A (Web browser — issue occurs in the Kiro web sign-in page, not the desktop IDE)

Kiro Version

N/A (Web sign-in — not the desktop IDE)

Bug Description

When attempting to sign in to the Kiro web application (https://app.kiro.dev/signin) using the "Sign in with AWS IAM Identity Center" option, clicking the CONTINUE button causes the browser to be redirected to http://localhost:3128/signin/callback?login_option=awsidc&issuer_url= — a localhost address — instead of the correct production callback URL.

This completely blocks sign-in for all users attempting to use AWS IAM Identity Center authentication. The browser immediately fails with:

ERR_CONNECTION_REFUSED
This site can't be reached — localhost refused to connect.

The root cause appears to be a hardcoded localhost:3128 callback URL that was left in the production environment from a local development configuration. The OAuth/OIDC redirect URI for the AWS IAM Identity Center flow is pointing to the developer's local machine instead of the live production server.

Steps to Reproduce

1. Open a web browser and navigate to https://app.kiro.dev/signin
2. On the sign-in page, locate the "Sign in with AWS IAM Identity Center" section, which displays a "Start URL" input field with the note: "Provided by an admin or help desk."
3. Enter a Start URL (e.g., your organization's AWS IAM Identity Center start URL).
4. Click the CONTINUE button.
5. Observe the browser redirect URL — it will redirect to http://localhost:3128/signin/callback?login_option=awsidc&issuer_url=
6. The browser immediately shows: ERR_CONNECTION_REFUSED — This site can't be reached. localhost refused to connect.

Expected Behavior

After clicking CONTINUE, the browser should redirect to the correct production OAuth/OIDC callback URL on app.kiro.dev (e.g., https://app.kiro.dev/signin/callback?login_option=awsidc&issuer_url=...), initiate the AWS IAM Identity Center authentication flow, and ultimately sign the user in successfully.

Under no circumstances should the redirect target a localhost address in a production environment.

Conversation ID

No response

Additional Context

Erroneous redirect URL observed:

http://localhost:3128/signin/callback?login_option=awsidc&issuer_url=

Expected redirect URL (production):

https://app.kiro.dev/signin/callback?login_option=awsidc&issuer_url=<start_url>

Impact: This is a critical / P0 blocker — it completely prevents any user from signing in via AWS IAM Identity Center on the production web app. The hardcoded localhost:3128 is almost certainly a developer proxy port left in the production build configuration (e.g., in an environment variable, OAuth client registration, or frontend config file).

Suggested fix: Ensure the OAuth redirect URI / callback base URL is read from an environment variable or deployment configuration, and that the production deployment uses https://app.kiro.dev as the base URL rather than http://localhost:3128.

[github-actions]

🤖 Potential Duplicate Detected

This issue appears to be similar to:

• #6255: Cannot login via CLI (85% similar)
• #5475: Login issues when switching between IdC and Social sign ins (85% similar)

What happens next?

• ⏰ This issue will be automatically closed in 3 days
• 🏷️ If this is not a duplicate, you can prevent automatic closure by adding a comment or reacting with 👎 to this message.
• 💬 Comment on the original issue if you have additional information

Why is this marked as duplicate?
Both issues report login/authentication problems, though #6255 is CLI-specific while the new issue is web-specific with AWS IAM Identity Center

[arbiyan]

👎 I have same issue while login using Kiro desktop

[github-actions]

Thank you for your feedback! 🙏

The duplicate label has been removed and this issue has been sent back for maintainer review.

A maintainer will review this issue shortly.

[ShaylinChetty]

I also have the same issue using Kiro on both Mac and Windows.
Any workarounds would be appreciated.

[swrosati]

I was hitting this issue too, but was just able to get it to work by trimming the start url:
https://{my_start_up}.awsapps.com/start/#/?tab=accounts to https://{my_start_up}.awsapps.com/start/

[saavoiaa0]

Hello,
Any updates on this case? I have an user with the same error, when we make the login with the cli it works, but in ide the issue persists.

[roalz]

I've had the same issue,
I specified https://{my_start_up}.awsapps.com/start
I made it work by adding the trailing slash: https://{my_start_up}.awsapps.com/start/
HTH

[wilsonprosdocimoeemovel]

I was able to authenticate successfully using the device flow.
Here are the steps I followed:

Ran the Kiro CLI with the --use-device-flow option.
Followed the authentication prompts shown in the terminal.
Opened the verification page in the browser and entered the confirmation code.
I was already logged into the web console on the same machine/browser session.
After confirming the code and close browser, the CLI authentication completed successfully.

[mertcanvural]

I hit a similar localhost callback miss on a remote auth flow once. If IAM Identity Center is still bouncing to localhost:3128 instead of the production callback, I'd log the exact callback host the client emits before the browser handoff, manual diff is enough to start, authproxy.dev helps if the broker or proxy is rewriting headers, and OAuth Redirect Doctor is useful if you want the app URL, callback path, and registered provider entry lined up together. tbh these usually break on one hardcoded host or port, not the provider itself.