Sandbox OAuth authorize endpoint reaches CH identity, then fails before redirect callback

Sandbox OAuth authorize endpoint reaches CH identity, then fails before redirect callback.
Laravel callback is never reached.
No platform oauth_tokens row is created.
Sandbox REST API works successfully.
Configured scope:

https://identity.company-information.service.gov.uk/user/profile.read

Redirect URI: