Hi all, I have an app that works fine in local development, but authentication fails in production.

Server logs show a successful authentication logged from my authorize function (see below), and browser tools show __Secure-next-auth.session-token being set, but the status from useSession() is unauthenticated and the session is null.

Prod environment variables are set correctly:
NEXTAUTH_URL
NEXTAUTH_SECRET

But note I'm deploying this as a serverless Google Cloud Run instance. The reason I mention is, the call to /api/auth/session is a request to https://<garbled-junk>.a.run.app/api/auth/session rather than <NEXTAUTH_URL>/api/auth/session. Not sure if that's relevant.

nextauth is configured with Credentials provider very simply:
/api/auth/[...nextauth].js

export const authOptions = {
  providers: [
    CredentialsProvider({
      name: "MyProvider",
      credentials: {
        username: { label: "Username", type: "text", placeholder: "username" },
        password: { label: "Password", type: "password" }
      },
      async authorize(credentials, req) {
        const userData = await myLoginFunc(credentials.username, credentials.password);
        if (userData) {
          const session = { 
            name: credentials.username
          }
          console.log('Login successful, returning id/username');
          console.log(session);
          return session;
        } else {
          return null;
        }
      }
    })
  ],
  session: {
    strategy: 'jwt',
  },
  jwt: {
    secret: process.env.JWT_SECRET,
  },
  debug: true
}

export default NextAuth(authOptions)