Family Tree Export page: OAuth authorization fails with "redirect URI not configured correctly"

Matthew Faulconer · August 12

Page: https://www.familysearch.org/innovate/export

What happens

Signed in to FamilySearch, I clicked Download GEDCOM File. The browser goes to ident.familysearch.org and shows:

Invalid Oauth2 Request
Oauth2 error: redirect URI not configured correctly

No file downloads. Reproduced 2026-08-11.

Cause

The authorization URL is assembled in an inline script on the export page itself, from two
literal values:

client_id    a02j000000KTRjpAAH
redirect_uri https://www.familysearch.org/innovate/export

The production identity server rejects that redirect URI for that client, which means the URI is
not registered against the client. Because both values are literals in the page, a user cannot
change either one through any account setting or developer registration, so this isn't a users error or anything specific to my account.

The page is written entirely in client-side JavaScript, which did make the diagnosis pleasant.

Suggested fix

Register https://www.familysearch.org/innovate/export as an allowed redirect URI for client
a02j000000KTRjpAAH on the production identity server.

Impact

This page is the documented route for a person who wants a copy of their own tree without buying third-party software.

Workaround, for anyone who lands here before it is fixed

The script does three things after login. Only the login step is broken. On a signed-in
familysearch.org tab, the fssessionid cookie is accepted directly as a bearer token by
api.familysearch.org. So the remaining steps run from the browser console on the export page, where the page's own GEDCOMXTo7 converter is already loaded:

const sid = decodeURIComponent(document.cookie.match(/(?:^|;\s*)fssessionid=([^;]+)/)[1]);
const h = { Authorization: 'Bearer ' + sid, Accept: 'application/json' };

const me = (await (await fetch(
  'https://api.familysearch.org/platform/users/current', { headers: h })).json()).users[0];

const gx = await (await fetch(
  `https://api.familysearch.org/platform/tree/ancestry?generations=8&personDetails=1&person=${me.personId}`,
  { headers: h })).json();

const ged = GEDCOMXTo7(gx, console.error);

That produced a valid GEDCOM 7 file for me. Both calls are read-only GETs against the signed-in user's own account.

For consideration while you are making this change:

The authorization request sends no state parameter and no PKCE code challenge. The
authorization code returns to a page that exchanges it for a token in the browser. For a public client of this shape, consider adding state and PKCE.
The script decodes the id_token payload with atob and uses a sessionId claim from it as the bearer token for api.familysearch.org. Consider verifying the token's signature.

MandyShaw1 · August 12

@Matthew Faulconer this was raised previously, see

https://community.familysearch.org/en/discussion/188103/export-is-not-working-invalid-oauth2-request-window

I do not think the situation has changed since then. The key point is that this functionality is not part of FS' supported offerings; you need to use a third party product from the Solutions Gallery. The page you linked to is on the 'developer' side of the website.