After authorize you will be redirected, so the redirect URL needs to go somewhere where you can handle decrypting the payload it redirects with.
Also there is a site setting that lists where the redirect is allowed to go.
4 Likes