diff --git a/package.json b/package.json
index 83d15045..fe087a19 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "impro",
-  "version": "0.18.156",
+  "version": "0.18.157",
   "type": "module",
   "scripts": {
     "start": "rm -rf \"${BUILD_DIR:-build}\" && NODE_ENV=development eleventy --serve",
diff --git a/src/_includes/head.html b/src/_includes/head.html
index 93790435..19889459 100644
--- a/src/_includes/head.html
+++ b/src/_includes/head.html
@@ -44,7 +44,6 @@
     oauthOptionalScopes: "{{ oauthOptionalScopes }}",
     playwright: "{{ playwright }}" === "true",
     useConfidentialOauth: "{{ useConfidentialOauth }}" === "true",
-    oatproxyClientId: "{{ oatproxyClientId }}",
   };
 </script>
 <script>
diff --git a/src/js/auth.js b/src/js/auth.js
index 5094d62d..736ad91b 100644
--- a/src/js/auth.js
+++ b/src/js/auth.js
@@ -206,19 +206,9 @@ export class OAuthProvider {
 
   async getClient() {
     if (!this._client) {
-      const proxyClientId = window.env.oatproxyClientId || null;
-      const proxyOrigin = proxyClientId ? new URL(proxyClientId).origin : null;
-      const baseRedirect = `https://${window.env.hostName}/callback.html`;
-      const redirectUri =
-        proxyOrigin && new URL(baseRedirect).origin !== proxyOrigin
-          ? `${proxyOrigin}?oatproxyActualRedirect=${encodeURIComponent(baseRedirect)}`
-          : baseRedirect;
       this._client = await OauthClient.load({
-        clientId:
-          proxyClientId ??
-          `https://${window.env.hostName}/oauth-client-metadata.json`,
-        redirectUri,
-        proxyUrl: proxyOrigin,
+        clientId: `https://${window.env.hostName}/oauth-client-metadata.json`,
+        redirectUri: `https://${window.env.hostName}/callback.html`,
       });
     }
     return this._client;
diff --git a/src/js/oauth.js b/src/js/oauth.js
index 477b49a1..00f3fce0 100644
--- a/src/js/oauth.js
+++ b/src/js/oauth.js
@@ -580,22 +580,20 @@ export class InvalidAuthUrlError extends Error {
 }
 
 export class OauthClient {
-  constructor({ clientId, redirectUri, dpopKeypair, proxyUrl = null }) {
+  constructor({ clientId, redirectUri, dpopKeypair }) {
     this.clientId = clientId;
     this.redirectUri = redirectUri;
-    this.proxyUrl = proxyUrl;
     this.dpopRequests = new DPoPRequests(dpopKeypair);
     this.sessionsByDid = new Map();
   }
 
-  static async load({ clientId, redirectUri, proxyUrl = null }) {
+  static async load({ clientId, redirectUri }) {
     const dpopKeypair = await loadOrGenerateDPoPKeypair();
     migrateLegacySession();
     return new OauthClient({
       clientId,
       redirectUri,
       dpopKeypair,
-      proxyUrl,
     });
   }
 
@@ -606,8 +604,7 @@ export class OauthClient {
     }
     const { did, didDoc } = result;
     const pdsEndpoint = getServiceEndpointFromDidDoc(didDoc);
-    const serviceEndpoint = this.proxyUrl ?? pdsEndpoint;
-    const resourceMetadata = await fetchResourceServerMetadata(serviceEndpoint);
+    const resourceMetadata = await fetchResourceServerMetadata(pdsEndpoint);
     if (
       !resourceMetadata.authorization_servers ||
       resourceMetadata.authorization_servers.length !== 1
diff --git a/src/src.11tydata.js b/src/src.11tydata.js
index 6b10706b..b7b5ed23 100644
--- a/src/src.11tydata.js
+++ b/src/src.11tydata.js
@@ -14,5 +14,4 @@ export default {
   oauthOptionalScopes: OPTIONAL_OAUTH_SCOPES,
   oauthPublicJwk: process.env.OAUTH_PUBLIC_JWK ?? "",
   useConfidentialOauth: process.env.OAUTH_PUBLIC_JWK ? "true" : "",
-  oatproxyClientId: process.env.OATPROXY_CLIENT_ID ?? "",
 };
diff --git a/tests/unit/env.js b/tests/unit/env.js
index 7c3e510b..9854c7af 100644
--- a/tests/unit/env.js
+++ b/tests/unit/env.js
@@ -34,7 +34,6 @@ globalThis.window.env = {
   oauthOptionalScopes: "",
   playwright: false,
   useConfidentialOauth: false,
-  oatproxyClientId: "",
 };
 
 // Node has its own global navigator; alias JSDOM's so code under test and