Hi Paul,
If you are having this issue in your published application but not getting this issue in localhost, this almost always means that there's a mismatched reference to a reply URI/redirect URI somewhere in either the code or the app registration in the portal. These need to match exactly and have the same https protocol.
Ensure that all references in your code and in your app registration direct to the URL of the published application where you want the customer to land after sign-in. Also, double-check that all app ID/client ID, tenant ID, tenant name, and other application identifiers are matching in both places if you haven't done so already.