diff --git a/README.md b/README.md
index d8c8379..5253006 100644
--- a/README.md
+++ b/README.md
@@ -63,14 +63,26 @@ cd server && npm install && npm run dev   # :3010
 cd client && npm install && npm run dev   # :3080 in prod, :5190 locally
 ```
 
-Register two redirect URIs in the Spotify dashboard (exact string match,
-trailing slash matters):
+Register **four** redirect URIs in the Spotify dashboard — one pair per
+environment, host mode and guest mode each need their own. Exact string
+match, trailing slash included: guest mode is `${window.location.origin}/`
+(`client/src/lib/pkce.ts`) — that trailing slash is not optional, ever,
+in any environment.
 
-- `http://127.0.0.1:3010/api/spotify/callback` — host mode
-- `http://127.0.0.1:5190/` — guest PKCE mode (root, no path)
+| Environment | Host mode (`/api/spotify/callback`) | Guest PKCE mode (root, no path) |
+|---|---|---|
+| Local dev | `http://127.0.0.1:3010/api/spotify/callback` | `http://127.0.0.1:5190/` |
+| Production | `https://<your-domain>/api/spotify/callback` | `https://<your-domain>/` |
 
-(`127.0.0.1`, not `localhost` — Spotify's HTTPS-required-for-redirect
-policy only exempts the literal loopback IP.)
+(`127.0.0.1`, not `localhost`, for local dev — Spotify's
+HTTPS-required-for-redirect policy only exempts the literal loopback IP.)
+
+All four need to actually exist in the dashboard's list — host mode and
+guest mode failing to match are indistinguishable from the outside
+("redirect_uri: Not matching configuration" either way), so if this
+error shows up, check the browser's actual address bar at the point of
+failure to see which flow's redirect_uri is actually being sent before
+assuming which one is missing.
 
 ## Deploying