Unable to fully authenticate using oauth: Error code 400

Here is my code:

from flask import Flask, redirect, request
from boxsdk import Client
from boxsdk import OAuth2

import config_oauth
import requests
import logging

app = Flask(__name__)

# Create new OAuth client & csrf token                                                                                                    
oauth = OAuth2(
  client_id=config_oauth.client_id,
  client_secret=config_oauth.client_secret
)
csrf_token = ''


# Create Box redirect URI with csrf token and redirect user                                                                               
@app.route('/login')
def start():
  global csrf_token
  auth_url, csrf_token = oauth.get_authorization_url(config_oauth.redirect_uri)

  return redirect(auth_url)

# Fetch access token and make authenticated request                                                                                       
@app.route('/get')
def capture():
  # Capture auth code and csrf token via state                                                                                            
  code = request.args.get('code')
  state = request.args.get('state')

  # If csrf token matches, fetch tokens                                                                                                   
  assert state == csrf_token
  access_token, refresh_token = oauth.authenticate(code)       # CODE BREAKS HERE

  client = Client(oauth)

  return "Done"

See comment where my code breaks. I keep getting an error code 400, not sure why. Here is the exact printout of the error message that I receive back:

BoxOAuthException: 
Message: None
Status: 400
URL: https://api.box.com/oauth2/token
Method: POST
Headers: {'Content-Length': '83', 'Set-Cookie': 'box_visitor_id=5c700b6c75c633.73632444; expires=Sat, 22-Feb-2020 14:47:08 GMT; Max-Age=31536000; path=/; domain=.box.com; secure, bv=OPS-42881; expires=Fri, 01-Mar-2019 14:47:08 GMT; Max-Age=604800; path=/; domain=.app.box.com; secure, cn=11; expires=Sat, 22-Feb-2020 14:47:08 GMT; Max-Age=31536000; path=/; domain=.app.box.com; secure, site_preference=desktop; path=/; domain=.box.com; secure', 'Age': '0', 'Strict-Transport-Security': 'max-age=31536000', 'Connection': 'keep-alive', 'Cache-Control': 'no-store', 'Date': 'Fri, 22 Feb 2019 14:47:08 GMT', 'Content-Type': 'application/json'}