diff --git a/Changes b/Changes
index 7b6227b..5a74a15 100644
--- a/Changes
+++ b/Changes
@@ -24,6 +24,7 @@
         - Don't send empty pipes and states via query param (diewald)
         - Fix access of iframe location in tutorials. (diewald)
         - Fix test that wrongly required SSL support. (diewald)
+        - URLs for plugins are mandatory (closes # 322; hebasta)
 
 0.58 2024-11-15
         - Cookie path is settable now (hebasta)
diff --git a/dev/scss/base/form.scss b/dev/scss/base/form.scss
index 18ad3d4..70e6bcf 100644
--- a/dev/scss/base/form.scss
+++ b/dev/scss/base/form.scss
@@ -170,6 +170,11 @@
     color:   $ids-blue-1;
     content: '*';
   }
+
+  span.field-required{
+    color:   $ids-blue-1;
+  }
+
 }
 
 .button-abort {
diff --git a/lib/Kalamar/Plugin/Auth.pm b/lib/Kalamar/Plugin/Auth.pm
index 489b246..eaaf026 100644
--- a/lib/Kalamar/Plugin/Auth.pm
+++ b/lib/Kalamar/Plugin/Auth.pm
@@ -100,6 +100,7 @@
           redirectUri => 'Weiterleitungsadresse',
           pluginSrc => 'Beschreibung des Plugins (*.json-Datei)',
           homepage => 'Webseite',
+          homepageReq => '*(Plugins)',
           desc => 'Kurzbeschreibung',
           revoke => 'Widerrufen',
           clientCredentials => 'Client Daten',
@@ -173,6 +174,7 @@
           redirectUri => 'Redirect URI',
           pluginSrc => 'Declaration of the plugin (*.json file)',
           homepage => 'Homepage',
+          homepageReq =>'*(Plugins)',
           desc => 'Short description',
           revoke => 'Revoke',
           clientCredentials => 'Client Credentials',
@@ -1264,9 +1266,16 @@
       $v->required('name', 'trim', 'not_empty')->size(3, 255);
       $v->required('type')->in('PUBLIC', 'CONFIDENTIAL');
       $v->required('desc', 'trim', 'not_empty')->size(3, 255);
-      $v->optional('url', 'trim', 'not_empty')->like(qr/^(http|$)/i);
       $v->optional('redirect_uri', 'trim', 'not_empty')->like(qr/^(http|$)/i);
       $v->optional('src', 'not_empty');
+     
+      my $src = $v->param('src');
+      if ($src && ref $src && $src->size > 0){
+        $v->required('url', 'trim', 'not_empty')->like(qr/^(http|$)/i);
+        }
+      else{
+        $v->optional('url', 'trim', 'not_empty')->like(qr/^(http|$)/i);
+      }
 
       $c->stash(template => 'auth/clients');
 
@@ -1285,8 +1294,9 @@
       };
 
       my $type = $v->param('type');
-      my $src = $v->param('src');
       my $src_json;
+ 
+  
 
       my $json_obj = {
         name         => $v->param('name'),
@@ -1313,7 +1323,7 @@
 
         # Check upload is not empty
         if ($src->size > 0 && $src->filename ne '') {
-
+      
           # Plugins need to be confidential
           if ($type ne 'CONFIDENTIAL') {
             $c->notify(error => $c->loc('Auth_confidentialRequired'));
diff --git a/lib/Kalamar/Plugin/Auth/templates/auth/clients.html.ep b/lib/Kalamar/Plugin/Auth/templates/auth/clients.html.ep
index e25d63f..c912bc8 100644
--- a/lib/Kalamar/Plugin/Auth/templates/auth/clients.html.ep
+++ b/lib/Kalamar/Plugin/Auth/templates/auth/clients.html.ep
@@ -47,7 +47,10 @@
     </div>
 
     <div>
-      %= label_for url => loc('Auth_homepage')
+      %= label_for url => begin  
+        %=loc('Auth_homepage')
+        %=t span =>(class => 'field-required')=> loc('Auth_homepageReq')
+      %end
       %= url_field 'url', placeholder => 'https://...'
     </div>
 
diff --git a/t/plugin/auth-oauth.t b/t/plugin/auth-oauth.t
index b135f96..ae385bf 100644
--- a/t/plugin/auth-oauth.t
+++ b/t/plugin/auth-oauth.t
@@ -489,7 +489,8 @@
   ->text_is('label[for=name]','Name of the client application')
   ->text_is('label[for=type]','Type of the client application')
   ->text_is('label[for=desc]','Short description')
-  ->text_is('label[for=url]','Homepage')
+  ->text_like('label[for=url]'=> '/Homepage/')
+  ->element_exists('label[for=url] > span.field-required')
   ->text_is('label[for=redirect_uri]','Redirect URI')
   ->text_is('label[for=src]','Declaration of the plugin (*.json file)')
   ->element_exists('ul.client-list')
@@ -1221,10 +1222,12 @@
   name => 'Funny',
   type => 'PUBLIC',
   desc => 'This is my plugin application 2',
+  url => 'https://xyz/123',
   csrf_token => $csrf,
   src => 'hMMM'
 };
 
+
 $t->post_ok('/settings/oauth/register' => form => $json_post)
   ->status_is(200)
   ->element_exists('div.notify-error')