That return URL's host is not on the allow-list

While the tenant setting allowed_return_hosts is non-empty, every return_url — on a link, on a payment created with checkout, and on a link open — must have a host on that list. An open redirect on a payment page is a phishing primitive, so the list is enforced rather than advisory.

What to do

Add the host in the dashboard, or send a return_url on a host that is already listed. An empty allow-list disables the check entirely, which is a decision to make deliberately rather than by leaving it unset.