A redirect URL inside another URL must be encoded as a single parameter value. That means the inner URL's :, /, ?, &, and = characters need to be percent-encoded so they do not interfere with the outer URL.
For manual redirect links, encode the inner target with the URL Encode tool before adding it to the outer parameter.
How do I encode a redirect URL inside another URL?
Encode the redirect URL as one complete component before inserting it into the outer URL. For example, https://site.test/thanks?order=123 becomes https%3A%2F%2Fsite.test%2Fthanks%3Forder%3D123 when used as a redirect_uri value.
Why does the inner ampersand break the outer URL?
The inner ampersand breaks the outer URL because the outer parser sees it as a separator for another outer parameter. Encoding the inner URL changes & to %26, preserving it as part of the redirect value.
Why is OAuth redirect URI encoding so strict?
OAuth redirect URI encoding is strict because the authorization URL has its own query string and the redirect_uri parameter is itself a URL. If the inner URL is not encoded exactly, parameters can be lost, changed, or interpreted at the wrong layer.
Should I encode the redirect URL once or twice?
Usually encode the redirect URL once as the value of the outer parameter. Encode twice only if a documented API requires an already encoded URL to pass through another encoded layer. If you are unsure, decode one layer at a time to inspect it.
How do I read a nested redirect URL?
Read a nested redirect URL by extracting the outer parameter first, then decoding that value. The URL Decode tool is useful here: decode the redirect_uri, next, or return_to value separately from the full URL.
What characters matter most in nested URLs?
The most important characters are :, /, ?, #, &, and =. These characters define URL structure, so they must be encoded when the whole inner URL is being carried as data inside an outer URL.
What is the safest manual workflow?
First copy the inner destination URL. Then encode it with the URL Encode tool. Finally paste the encoded result as the outer parameter value and test by decoding only that value to confirm it round-trips correctly.