right, so I'm guessing you're using the common endpoint in the oauth proxy to make sure you don't have to fill in a tenant ID, as when I changed the application to multitenant it started working