[TW-4786] feat(admin): add callback URI CRUD and fix auth config

docs/COMMANDS.md

@@ -788,7 +788,7 @@ nylas scheduler sessions show <session-id>            # Show session details
 
 ## Admin (API Management)
 
-Manage Nylas applications, connectors, credentials, and grants.
+Manage Nylas applications, callback URIs, connectors, credentials, and grants.
 
 ```bash
 # Applications
@@ -798,6 +798,13 @@ nylas admin applications create                       # Create application
 nylas admin applications update <app-id>              # Update application
 nylas admin applications delete <app-id>              # Delete application
 
+# Callback URIs (OAuth redirect endpoints)
+nylas admin callback-uris list                        # List callback URIs
+nylas admin callback-uris show <uri-id>               # Show callback URI
+nylas admin callback-uris create --url <url>          # Create callback URI
+nylas admin callback-uris update <uri-id> --url <url> # Update callback URI
+nylas admin callback-uris delete <uri-id>             # Delete callback URI
+
 # Connectors (provider integrations)
 nylas admin connectors list                           # List connectors
 nylas admin connectors show <connector-id>            # Show connector

docs/commands/admin.md

@@ -63,6 +63,62 @@ Callback URIs (2):
   2. https://myapp.com/oauth/redirect
 ```
 
+### Callback URIs
+
+Manage OAuth callback URIs for your Nylas application. These are the redirect endpoints used during OAuth authentication flows.
+
+```bash
+# List callback URIs
+nylas admin callback-uris list
+nylas admin cb list                # Alias
+nylas admin callbacks list --json  # Output as JSON
+
+# Show callback URI details
+nylas admin callback-uris show <uri-id>
+nylas admin cb show <uri-id> --json
+
+# Create callback URI
+nylas admin callback-uris create --url http://localhost:9007/callback
+nylas admin cb create --url https://myapp.com/oauth/callback --platform web
+
+# Update callback URI
+nylas admin callback-uris update <uri-id> --url https://myapp.com/new-callback
+nylas admin cb update <uri-id> --platform ios
+
+# Delete callback URI
+nylas admin callback-uris delete <uri-id>
+nylas admin cb delete <uri-id> --yes  # Skip confirmation
+```
+
+**Example: List callback URIs**
+```bash
+$ nylas admin callback-uris list
+
+Found 2 callback URI(s):
+
+ID                                    URL                             PLATFORM
+f454b6d7-22e4-4f22-8536-35b6c2706a5d  http://localhost:8080/callback  web
+732ae831-06e4-4fe2-91de-bd20b099ff38  http://localhost:9007/callback  web
+```
+
+**Example: Create callback URI**
+```bash
+$ nylas admin cb create --url http://localhost:9007/callback
+
+✓ Created callback URI
+  ID:       732ae831-06e4-4fe2-91de-bd20b099ff38
+  URL:      http://localhost:9007/callback
+  Platform: web
+```
+
+**Flags:**
+- `--url` - Callback URL (required for create)
+- `--platform` - Platform type: `web`, `ios`, `android` (default: `web`)
+- `--yes`, `-y` - Skip delete confirmation
+- `--json` - Output as JSON
+
+> **Note:** `nylas auth config` automatically creates a callback URI (`http://localhost:<port>/callback`) during initial setup. Use these commands to manage additional URIs or troubleshoot OAuth issues.
+
 ### Connectors
 
 Manage email provider connectors (Google, Microsoft, IMAP, etc.).

internal/adapters/nylas/admin.go

@@ -127,6 +127,94 @@ func (c *HTTPClient) DeleteApplication(ctx context.Context, appID string) error
 	return c.doDelete(ctx, queryURL)
 }
 
+// Callback URI Operations
+
+// ListCallbackURIs retrieves all callback URIs for the application.
+func (c *HTTPClient) ListCallbackURIs(ctx context.Context) ([]domain.CallbackURI, error) {
+	queryURL := fmt.Sprintf("%s/v3/applications/callback-uris", c.baseURL)
+
+	var result struct {
+		Data []domain.CallbackURI `json:"data"`
+	}
+	if err := c.doGet(ctx, queryURL, &result); err != nil {
+		return nil, err
+	}
+	return result.Data, nil
+}
+
+// GetCallbackURI retrieves a specific callback URI.
+func (c *HTTPClient) GetCallbackURI(ctx context.Context, uriID string) (*domain.CallbackURI, error) {
+	if err := validateRequired("callback URI ID", uriID); err != nil {
+		return nil, err
+	}
+
+	queryURL := fmt.Sprintf("%s/v3/applications/callback-uris/%s", c.baseURL, uriID)
+
+	var result struct {
+		Data domain.CallbackURI `json:"data"`
+	}
+	if err := c.doGetWithNotFound(ctx, queryURL, &result, domain.ErrCallbackURINotFound); err != nil {
+		return nil, err
+	}
+	return &result.Data, nil
+}
+
+// CreateCallbackURI creates a new callback URI for the application.
+func (c *HTTPClient) CreateCallbackURI(ctx context.Context, req *domain.CreateCallbackURIRequest) (*domain.CallbackURI, error) {
+	if req == nil {
+		return nil, fmt.Errorf("create callback URI request is required")
+	}
+	if err := validateRequired("callback URI URL", req.URL); err != nil {
+		return nil, err
+	}
+
+	queryURL := fmt.Sprintf("%s/v3/applications/callback-uris", c.baseURL)
+
+	resp, err := c.doJSONRequest(ctx, "POST", queryURL, req)
+	if err != nil {
+		return nil, err
+	}
+
+	var result struct {
+		Data domain.CallbackURI `json:"data"`
+	}
+	if err := c.decodeJSONResponse(resp, &result); err != nil {
+		return nil, err
+	}
+	return &result.Data, nil
+}
+
+// UpdateCallbackURI updates an existing callback URI.
+func (c *HTTPClient) UpdateCallbackURI(ctx context.Context, uriID string, req *domain.UpdateCallbackURIRequest) (*domain.CallbackURI, error) {
+	if err := validateRequired("callback URI ID", uriID); err != nil {
+		return nil, err
+	}
+
+	queryURL := fmt.Sprintf("%s/v3/applications/callback-uris/%s", c.baseURL, uriID)
+
+	resp, err := c.doJSONRequest(ctx, "PATCH", queryURL, req)
+	if err != nil {
+		return nil, err
+	}
+
+	var result struct {
+		Data domain.CallbackURI `json:"data"`
+	}
+	if err := c.decodeJSONResponse(resp, &result); err != nil {
+		return nil, err
+	}
+	return &result.Data, nil
+}
+
+// DeleteCallbackURI deletes a callback URI.
+func (c *HTTPClient) DeleteCallbackURI(ctx context.Context, uriID string) error {
+	if err := validateRequired("callback URI ID", uriID); err != nil {
+		return err
+	}
+	queryURL := fmt.Sprintf("%s/v3/applications/callback-uris/%s", c.baseURL, uriID)
+	return c.doDelete(ctx, queryURL)
+}
+
 // Admin Connectors
 
 // ListConnectors retrieves all connectors.