appCallbackUri

the URI your server 302s to, which your app declares as a deep link. An https:// App Link (with assetlinks.json and android:autoVerify="true") is the right choice; a custom scheme works but any app can register it, which is a real account-takeover vector.