The NodeOAuthClient validates that redirect_uri is in its registered redirect_uris before sending to the PDS. The /client-metadata.json endpoint correctly listed OIDC and forward-auth callback URIs, but the internal NodeOAuthClient instance only had the primary auth callback and proxy callback registered. This caused "TypeError: Invalid redirect_uri" when the OIDC authorize flow called generateAuthUrl with the OIDC callback URI, resulting in 500 errors for all OIDC-dependent apps (mdeditor, mydrawings). Fix: Pass additional redirect URIs (OIDC callback, forward-auth proxy callback) to OAuthService.initialize() so they're registered in the NodeOAuthClient's clientMetadata.redirect_uris array. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>