Found the issue, i believe 3LO might have supported comma separated “scope” before but now it does not. I removed prompt=consent while debugging, this caused the oauth to succeed but the 502 to occur. Once i used space separated scopes, the oauth prompt succeeds and everything worked.
I don’t know what the standard is, but i would recommend that you maybe handle both?