- custom_base_url=1 so Frappe prepends https://hanzo.id to authorize/token/ userinfo (relative paths were resolving to the Frappe host, breaking OAuth). - login_with_email_link=0 removes the native passwordless path; IAM SSO is the ONLY login. CR mirror -> 1.26.6.