We created an app that uses The Authorization code grant (PKCE). There are no issues in lower environments, which use a different app and integration key but the configuration is identical.

When invoking /oauth/auth, we get this message:

Here is a redacted version of the url: 

https://account.docusign.com/oauth/auth?response_type=code&client_id=REDACTED5d4b&redirect_uri=https%3A%2F%2Fourapp.com%2Fcallback%2FDOCUSIGN&code_challenge_method=S256&code_challenge=0vREDACTEDGu0f5ZM9oHDPQ&scope=signature

Note that response_type=code

Settings are below:

Allow CORS for OAuth calls 

Also, when we click “View Details”, it claims that we are using Implicit Grant. That makes no sense because we clearly have PKCE selected:

Does anyone have a clue as to what’s going on?