nginx was only forwarding /api/* to the backend. Added proxy locations for: - /oauth2/ (Spring Security login initiation) - /login/oauth2/ (OAuth2 authorization code callback) - /logout (Spring Security logout + RP-initiated end-session) Also revert incorrect /api prefix on the login redirect URL.