LOGTO_ENDPOINT and LOGTO_ADMIN_ENDPOINT are public-facing URLs that Logto uses for OIDC discovery, issuer URI, and redirects. When behind a reverse proxy (e.g., Traefik), set these to the external URLs. Logto requires its own subdomain (not a path prefix). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>