Vercel OAuth "Invalid URL" error despite exact match in Authorization Callback URLs

[awingmawe]

Describe the bug

When following the README to set up Vercel OAuth for authentication, the authorization flow fails with an "Invalid URL" error from Vercel, even though the redirect_uri parameter exactly matches the configured Authorization Callback URL in the Vercel App settings.

To Reproduce

1. Deployed a fork of open-agents to Vercel (e.g., domain open-agents-awingmawe.vercel.app).
2. Created a new OAuth2 Application in Vercel Dashboard (Team/Personal Settings > Apps).
3. Added the callback URL exactly as specified: https://open-agents-awingmawe.vercel.app/api/auth/callback/vercel.
4. Generated a Client Secret.
5. Added NEXT_PUBLIC_VERCEL_APP_CLIENT_ID and VERCEL_APP_CLIENT_SECRET to the project's Environment Variables.
6. Triggered a Redeploy of the Vercel project to ensure the new environment variables take effect.
7. Opened the app and clicked "Sign in with Vercel".
8. Redirected to the Vercel OAuth authorization page (e.g., https://vercel.com/oauth/authorize?...).
9. Encountered an "Invalid URL" error from Vercel.

Additional Context

• The redirect_uri parameter in the failing URL is URL-encoded but decodes to exactly https://open-agents-awingmawe.vercel.app/api/auth/callback/vercel, which perfectly matches the setting.
• I have tried deleting the Vercel App, creating a new one from scratch, updating the environment variables, and redeploying, but the issue persists.
• I am on a Hobby plan (though this shouldn't affect OAuth callback limits).
• The BETTER_AUTH_SECRET and POSTGRES_URL are configured and working.

Is there a hidden requirement for the callback URL, or an issue with how better-auth constructs the redirect_uri dynamically based on the host?

[aqilaziz]

I found one documentation mismatch that may contribute to this setup failure: the app reads BETTER_AUTH_URL and the deploy-your-own page requests it, but README/.env.example did not document it.

I pushed a small docs patch here, but this repository currently limits opening PRs to collaborators, so I cannot create the PR directly:
main...aqilaziz:open-agents:docs/auth-base-url-setup

The patch adds BETTER_AUTH_URL to the deploy button/env docs and notes that it must match the callback origin.