NEXT_PUBLIC_API_URL was baked at build time by Next.js, but docker-compose.yml only passed it as a runtime env var. On staging the frontend fell back to localhost:3000, breaking OAuth and all API calls from the browser. Browser-side requests now use relative URLs (empty string) so Caddy proxies them correctly. Server-side rendering uses API_INTERNAL_URL (defaults to http://localhost:3000 for local dev).