OAuth rejections are almost always an exact-string problem: a redirect URI encoded twice, a trailing slash, a duplicated parameter. This pass peels the encoding layers and compares against the value you registered.