services.bulwark.settings.oauth.authorizeUrl

Overrides only the user-facing authorize endpoint (e.g. a per-brand login host). Discovery, token exchange and refresh keep using settings.oauth.issuerUrl. Leave unset to use the authorization_endpoint from discovery.