Invalid State on subdomain login

hey folks, we are running into login issues on our development environments. we use render and it automatically creates a deployment for our PR with the domain https://admin-portal-pr-{number}.onrender.com . kinde is configured with https://admin-portal-*.onrender.com/ in allowed callback urls. we have a custom domain setup for auth for some reason, the deployments have "Invalid state" error in the console, and: - login page does not show up if token is cached previously - login page pops up, but then redirects to home with the error above, user is not logged in nothing has changed in the auth code between the PR and production/local, where login works perfectly. would love input!