When I first implemented the Bluesky OAuth authentication code, I hit this bug: bluesky-social/atproto#3489
It was just closed, and it looks like I was confused by a misleading error message, and the actual issue is that I was trying to redirect to social.cyd.dev-api://atproto-oauth-callback/ when I should be redirecting to social.cyd.dev-api:/atproto-oauth-callback/ (a single / instead of //).