diff --git a/src/auth.rs b/src/auth.rs
index 92371c4..18381b0 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -38,8 +38,11 @@ pub fn new_oauth_client(settings: &Settings) -> Result<BasicClient> {
         ),
     )
     .set_redirect_uri(
-        RedirectUrl::new(settings.auth.redirect_url.clone())
-            .context("failed to create new redirection URL")?,
+        RedirectUrl::new(format!(
+            "{}{}/auth/callback",
+            settings.frontend_host, settings.base_path
+        ))
+        .context("failed to create new redirection URL")?,
     ))
 }
 
diff --git a/src/settings.rs b/src/settings.rs
index 613c511..77cacdc 100644
--- a/src/settings.rs
+++ b/src/settings.rs
@@ -8,20 +8,29 @@ use crate::app_state::AppState;
 
 #[derive(Clone, Debug, Deserialize)]
 pub struct Settings {
+    /// Prefix under which to nest all routes. If specified, include leading
+    /// slash but no trailing slash, for example "/app". For default behavior,
+    /// leave as empty string.
     #[serde(default)]
     pub base_path: String,
 
+    /// postgresql:// URL.
     pub database_url: String,
 
     /// When set to 1, embedded Diesel migrations will be run on startup.
     pub run_database_migrations: Option<u8>,
 
+    /// Address for server to bind to
     #[serde(default = "default_host")]
     pub host: String,
 
+    /// Port for server to bind to
     #[serde(default = "default_port")]
     pub port: u16,
 
+    /// Host visible to end users, for example "https://shout.dev"
+    pub frontend_host: String,
+
     pub auth: AuthSettings,
 
     pub email: EmailSettings,
@@ -39,7 +48,6 @@ fn default_host() -> String {
 pub struct AuthSettings {
     pub client_id: String,
     pub client_secret: String,
-    pub redirect_url: String,
     pub auth_url: String,
     pub token_url: String,
     pub userinfo_url: String,