From the docs - https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession/2990952-init: callbackURLScheme The custom URL scheme that the app expects in the callback URL. Note "custom" URL scheme, which will allow ASWebAuthenticationSession to redirect back to your app and complete. If you need to redirect back to your app with an http(s) URL from an external user agent—that is, an authentication class like ASWebAuthenticationSession or a system browser—you'll need to do it on the OS level by using Universal Links - https://developer.apple.com/documentation/xcode/allowing_apps_and_websites_to_link_to_your_content. It's a big subject covered in the aforementioned doc and others referenced from there. In short, your redirection URI will point to a server where your apple-app-site-association file is hosted and a path specified for your app in this file. Then you'll need to handle the redirection in your app delegate's application(_:continue:restorationHandler:) method. You will also need to manually cancel your ASWebAuthenticationSession, as it will not complete on an http(s) redirection. I described a Universal Link implementation here: h ttps://developer.forgerock.com/docs/platform/how-tos/implementing-oauth-20-authorization-code-grant-protected-pkce-appauth-sdk-ios#simple-app-universal-links It was written a while ago and in the context of an OAuth 2 client built on top of the AppAuth SDK for iOS, but could still be a relevant compliment to the docs.

I've commented on a similar issue - https://developer.apple.com/forums/thread/658334?answerId=638461022#638461022. In short, you are to use Universal Links for HTTP(S) redirection back to the app. They do work, pending correct implementation (which, admittedly, may not always be too straight forward). WKWebView is not an exact functional replacement for ASWebAuthenticationSession. It is not suitable for an app developed by a different business entity than one managing the authentication/authorization system, a third-party app, which is not supposed to have access to the user credentials. And, WKWebView cannot provide SSO experience between apps belonging to different development teams, which includes the system browsers.