I spent today reading OAuth bug threads and the same 4 drifts kept coming up: app URL, auth base URL, callback path, and the provider allow-list.
tbh the fastest fix is still to capture the exact redirect_uri leaving your app, then diff those 4 side by side.
I opened a free preview of OAuth Redirect Doctor for exactly that: https://oauth-redirect-doctor.vercel.app?utm_source=ih&utm_medium=post&utm_campaign=ih-roundup-2026-05-31