redirect_url_invalid

When it happens

A redirect_url (where the user goes after signing in, after a social sign-in, or after an email link) is not an absolute http or https URL on one of the instance’s allowed origins (see origin_invalid), has a user name or password in it, or has a query or fragment parameter whose name starts with __zautha_ (those are Zautha’s own). Zautha never redirects to a URL it does not know. The hosted login page shows an error instead of the form when it is opened with such a redirect_url.

What to do

Use a URL on your app’s origin, and add that origin to the instance’s allowed origins in the dashboard (Auth settings, Allowed origins).