Critical Auth Error: "Malformed Link" blocking all user logins (Server-side redirect bug)

Hi everyone,

I’m experiencing a critical authentication issue on my Glide app. Whenever a user tries to sign in (via Google or email), the authorization fails immediately after approval with the following error:

“Sign-in failed: This sign-in link is malformed. Open the app again.”

Here is what I’ve already checked:

  • It happens across all devices, networks, and browsers (incognito mode, Safari, Chrome, Samsung Internet, etc.).

  • It affects all users, completely locking everyone out of the paid functionality.

  • This is clearly a server-side authentication/redirect URL issue on Glide’s end for this specific project.

Support and the AI bot keep suggesting clearing cache or checking extensions, but this is happening globally for the app.

Has anyone else experienced this recently, or can a Glide team member please escalate this to engineering? My app is currently completely unusable.

Thanks for any help or insights!

I believe a fix for this issue was deployed a few hours ago.

Sadly did not help me.

Diagnostic Data:

GlideOS sign-in handoff diagnostic
time: 2026-07-29T16:02:58.779Z
request: POST /api/app-login/p0371b2a2-gramatas/handoff
failure: http
status: 400
handoff-code: invalid_return_to
content-type: application/json
body-is-json: true
cf-ray: a22d59d54b7d440a-VNO
server: cloudflare
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0

Problem Description:
* The app successfully loads and opens fine via the custom domain (`www.kodoligi.lv`).

* However, authentication and sign-in fail completely with a `400` status code and a `invalid_return_to` handoff error.

* The domain was recently changed from its Punycode version (`xn--kodolgi-9za.lv`) to the standard text format (`www.kodoligi.lv`), but this did not resolve the issue.

* DNS CNAME records and domain re-linking have been verified and re-configured multiple times, but the authorization flow still rejects the return URL.