Firebase Dynamic Links losing app parameters in Capacitor Browser redirect chain on Heroku

Question

I have a weird issue with Firebase Dynamic Links in my Capacitor app. When using deep links to authenticate users via SAML, it looks to be losing specific URL parameters but only in my staging environment on Heroku.

The flow

1. User enters domain name and clicks "Login with SSO"
2. App calls my GraphQL endpoint to get a redirectUrl
3. App opens this URL using Browser.open({ url: redirectUrl })
4. User authenticates with their SSO provider
5. SSO provider redirects back to my SAML callback endpoint on my API
6. API adds token to the URL and redirects to the return URL (via res.redirect) (which is a Firebase Dynamic Link)
7. Firebase Dynamic Link should open my app with all parameters

What works

• In local environment (local API server): all parameters are preserved through the redirect chain and the entire flow works from being redirected to the SSO entry point to being logged in and opened on the app.
• If I copy/paste the exact same URL from logs into WhatsApp and click it, it works perfectly.

What doesn't work

• In staging environment (Heroku): the app-specific parameters (apn, ibi, ofl) are missing after the redirect chain.
• When I inspect the URL in the Capacitor Browser after the SSO flow completes, I only see the URL up to the auth token, but the app parameters are missing.

Code

I'm using Capacitor Browser to open the link:

// This works locally but not in staging
Browser.open({ url: redirectUrl });

The full URL from server logs (works correctly):

https://myapp.page.link/?link=https%3A%2F%2Flink.myapp.com%2F%3Fauth_token%3DeyJ0eXAi...&apn=com.mycompany.app&ibi=com.mycompany.app&ofl=get.myapp.com

What I see in Capacitor Browser after redirect (truncated):

https://myapp.page.link/?link=https%3A%2F%2Flink.myapp.com%2F%3Fauth_token%3DeyJ0eXAi...

Notice how the parameters apn, ibi, and ofl are missing from the URL after the redirect chain.

What I've tried

• Adding url.toString() in the redirect call
• Verified the logs show the complete URL before redirecting
• Confirmed that the parameters are preserved when testing locally
• Tested that copying the URL directly works (bypassing the redirect chain)

The primary difference between my environments is that the staging API runs on Heroku while my local API runs directly on my development machine.

What could be causing Heroku to drop these specific parameters during the redirect chain? I just don't quite understand why the entire flow works perfectly fine locally but not when the API is deployed on Heroku, it could be a red herring.