What looks strange to me is, that you say that the callback is to the following path: /app-welcome-screen, but that redirect is not registered, so in that case ZITADEL would already fail on the initial call, with a message that the redirect url is wrong