Sorry for the confusion. Auth requests work on bsky.social or directly.
Because auth requests sent to the *.host.bsky.network PDS hosts will get proxied to bsky.social
(This needs to be documented properly, but none of this is required. Sending all requests to bsky.social is totally fine for now.)