Free Developer account. Two User OAuth 2.0 Platform Apps on the same enterprise; both ENABLED. Authorization column shows "---" for both.
Symptom on App A:
- Authorize URL loads; login + Grant Access UI work
- After Grant Access → Application Error / invalid_client on the authorize page
- Never redirects to registered loopback URI; local catcher never gets ?code=
- Token exchange never runs (Client Secret unused)
Control: same authorize flow fails for both the free Developer app-owner login and a separate personal Box login (file owner).
App B (sibling User OAuth on same enterprise) previously completed Grant successfully. Console config is the same class: User OAuth 2.0, redirect saved, Read+Write, unpublished, as-user off, CORS empty. Only intentional difference is the redirect URI (different loopback port/path for two tools).
Already ruled out on our side: redirect typo (Details match Console), AI/Sign scopes on/off, authorize host, minimal client_id+response_type URL, Collaborators/Publishing mismatch vs App B, Developer Token on App A.
Happy to share Client IDs + Show Details screenshot with a Box employee privately. Can this be escalated to Product Support? Free Dev cannot open a support.box.com case.