After too many hours of hacking, I discovered that the redirect that comes back is sometimes using http, not https. Curiously, for me it's happening on production, but not locally. Here's my solution, but surely there's a better way. ```php $client = $this->clientRegistry->getClient($clientKey); // key used in config/packages/knpu_oauth2_client.yaml $redirect = $client->redirect($scopes[$clientKey] ?? [], ['state' => $client->getOAuth2Provider()->getState()]); // assert(str_starts_with('https://', $redirect->getTargetUrl()); $redirect->setTargetUrl(str_replace('http%3A', 'https%3A', $redirect->getTargetUrl())); return $redirect; ```