I’ve tried to get the token in several ways. My preferred method, using a library called simple-oauth2
At the UI the process begins with a call to /oauth/authorize
The callback is received with the code and forwarded to my server at [originationURL]/auth
I’ll retrieve the code from the redirect request and feed it to simple-oauth2 in the following way.
const options = {
code: code,
redirect_uri: config.redirectUri
};
config.oauth2.authorizationCode.getToken(options, (error, result) => {
if (error) {
console.error('Access Token Error', error.message);
return res.json('Authentication failed');
}
console.log('The resulting token: ', result);
const token = config.oauth2.accessToken.create(result);
return res
.status(200)
.json(token);
});
The result is always a 500. I can trigger the 401 as you described by ommitting or changing any of the arguments in the querystring, such as clientId or secret, redirect_url, code, etc.
To ensure the library in use was not the culprit, I wrote my own request using requestjs.
var request_options = {
grant_type: 'authorization_code',
code: code,
client_id: config.options.clientId,
client_secret: config.options.clientSecret,
redirect_uri: REDACTED,
scope: 'app'
}
request.post({
url:config.options.accessTokenUri,
headers:{
'content-type': 'application/x-www-form-urlencoded'
},
qs: request_options
}, function (error, response, body) {
if (response.statusCode > 400){
return res.sendError("something went wrong");
}
if (error) {
return res.sendError(error);
} else if (body) {
var headers = { 'User-Agent': 'Satellizer' };
var all_things = JSON.parse(body)
return res.json(all_things);
} else {
return console.log("No Body")
}
});
I get the same error.
It’s been mentioned that the redirectUri may not be internet accessible. This is plainly false. I have had this successfully working in a local environment prior to the 15th of this month. In addition I’ve published to the qa environment, hosted in Azure, which is totally accessible with the same results.
I would note, that I have tried several other oauth2 libraries in place of the two examples above with the same results.
I’d also point out, the simple-oauth2 code in the first example, worked fine prior to the update on the 15th of this month. It ceased working with no changes.
One last thing to note, if I change my requests to use another code flow provider (such as github), the code with no changes except in the passed parameters works fine.
Please, for all that is good and holy, look at the original support request I sent in, with the UID of one of my requests that is presented in the subsequent ST reply and check your logs for some hint at what the problem is. It cannot be discerned from my end because of the generic resulting 500.
PS. Apparently my forum account has been re-enabled. 
. A 500 is normally a server saying it doesn’t know what to do with your request such as trying to hit an endpoint that doesn’t exist.