Providers link to HTTP version of site not HTTPS

[zimonitrome]

I am hosting a site on Digitalocean using a reverse proxy. So everything under http://localhost:3000 is mapped to https://mysite.com/ everything works great except authjs. Clicking signin correctly takes me to https://mysite.com/api/auth/signin?csrf=true but on that site, my buttons link to HTTP versions of my site:

And clicking those buttons works but the browser stops me and says that site is not secure to login on.

How can I fix this?

[zimonitrome]

I tried both:
export NEXTAUTH_URL=localhost:3000
and
export NEXTAUTH_URL=https://mysite.com
but both give the same result. Is this a clue?

[zimonitrome]

Do I need to "trust" my proxy somehow? Or does the callback not support HTTPS by default?

[maxhimmel]

I am facing the same issue using auth.js and an Express app hosted on Heroku. Would love some insight into this problem.

I've tried setting AUTH_REDIRECT_PROXY and NEXTAUTH_URL to https://my-domain.com/api/auth but it doesn't work.