I'm building a direct-developer integration (own business, not a tech provider) for WhatsApp Coexistence via Embedded Signup. The frontend flow completes successfully every time: FB.login() with config_id, extras featureType=whatsapp_business_app_onboarding and sessionInfoVersion=3, and scope whatsapp_business_management,whatsapp_business_messaging returns a valid-looking code (length ~430 chars) via response.authResponse.code.

The server-side exchange (GET /v25.0/oauth/access_token with client_id, client_secret, code) consistently fails with OAuthException code 100, error_subcode 36008: "Error validating verification code. Please make sure your redirect_uri is identical to the one you used in the OAuth dialog request."

This happens identically regardless of: - Including redirect_uri in the exchange call (tried matching the exact page URL, and omitting it entirely) - Graph API version (tested v21.0 and v25.0) - Whether the app is Published/Live or in Development mode - Browser/session state (reproduced on a completely fresh browser restart)

Separately, the postMessage WA_EMBEDDED_SIGNUP session event (which should report waba_id, phone_number_id, and event status) never fires at all in any attempt - only the classic FB.login callback returns a code.

App ID: 1413685630768978 Config ID: 1626375562169216 (created from Meta's own "WhatsApp embedded sign-up configuration with 60-day expiry token" template, Login Variation: WhatsApp Embedded Signup) Trace IDs: AGhrDDcB_ScOBH0ySu7YW19, A3uyPjwdsiTZMWzgrKJhx4y, AGZ-ArYsubsokN9Uqd9Y39_, ATpHPf-yPcwSka9pzJd2jQ2, ADM0cBgOH7uovO6lY-3OF-X

Any guidance on what's actually causing this validation failure, given redirect_uri handling doesn't change the outcome, would be much appreciated.