Encode reserved characters in query parameters (spaces, &, =, ?, #, non-ASCII). APIs and OAuth redirects often fail when encoding is wrong.

Encode each component appropriately—encoding an entire URL including scheme can double-encode if you are not careful.