---
id: KEY-WP-0010
type: workplan
title: "Admit the operator-tunneled OpenBao callback"
domain: infotech
repo: key-cape
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-08-23"
updated: "2026-08-23"
depends_on:
  - RAILIANCE-WP-0027
state_hub_workstream_id: "8bdf9a24-9dc1-53f9-9448-3b29c36d9950"
---

# KEY-WP-0010 — OpenBao operator loopback callback

## Admit and validate the exact callback

```task
id: KEY-WP-0010-T01
status: done
priority: high
state_hub_task_id: "46d78907-bda4-5cc9-853d-98c0026d9fe1"
```

Added the exact operator-only callback
`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the
source-owned `openbao-admin` static client in `config/dev-config.yaml`. The
registration retains exact-match redirects and does not authorize a login,
change the OpenBao role, broaden a listener, or handle a credential. A config
test pins the exact URI and proves the complete source config validates.