Can you share a bit more about the specific requests you’ve set up? (Maybe while filtering out the actual URL of your tenant)
Can you also check your tenant logs? Are you seeing anything out of the ordinary there? In your case, I think “failed exchange” or “successful exchange” would be the ones we’re looking for. Or, if those aren’t there at all, that’s also telling: then Apple isn’t even trying to exchange the code for an access token.