Passport answers token failures with a generic `invalid_request` description and puts the actual cause in `hint` (invalid redirect URI, expired or revoked code, code issued to another client…). The proxy dropped it, so sign-in showed only "The request is missing a required parameter…". It is now appended to the error message and logged with the grant type and client id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>