Production client ID returns HTTP 200 OAuth2 Error — non-production ID returns HTTP 302 — same request

[Wilbert Jackson]

I have a patient-facing SMART on FHIR app registered on Epic on FHIR (App ID 55838, Nutrilog 4visionCare). Both apps are Production Ready with 513 downloads and USCDI v1 auto-distribution enabled.

The problem: Every production client ID I create returns HTTP 200 OAuth2 Error from the authorize endpoint. The non-production client ID returns HTTP 302 correctly. Tested against 5+ health systems including BILH, AdventHealth, Advocate Aurora, Mass General Brigham, and the Epic sandbox. All production IDs fail against all endpoints.

Curl proof:

Non-production ee70448e → HTTP 302 ✅

curl "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/authorize?response_type=code &client_id=ee70448e-6af3-4138-a1a1-5842cbdba7cb &redirect_uri=https://4vision.com/nutrition-lookup.html &scope=launch/patient+patient/MedicationRequest.read+openid+fhirUser &state=test123 &code_challenge=Xilyp7X5i3hORXaTyY5bAUacdlJlJa5O1CzjlxXZl7Q &code_challenge_method=S256 &aud=https://epicproxy.et1082.epichosted.com/FHIRProxy/api/FHIR/R4/" → HTTP 302 Location: mychart-fhir/Authentication/OAuth/Start?client_id=ee70448e...

Production c05fa09c → HTTP 200 OAuth2 Error ❌

Same request with client_id=c05fa09c-2073-4d69-b535-0e2cb748e323 → HTTP 200 <title>OAuth2 Error</title>

Production cd04ae81 (second app, ID 56015) → HTTP 200 OAuth2 Error ❌

Same request with client_id=cd04ae81-9ec0-4cf6-b59a-987e11ea8360 → HTTP 200 <title>OAuth2 Error</title>

What I have ruled out:

• App configuration — two separate apps both fail
• Scope issues — tested with minimal scopes
• aud parameter — tested against 5 health systems and sandbox
• Redirect URI — exact match confirmed
• Browser cache — confirmed via curl from server command line
• Client sync delay — issue persists 48+ hours after Production Ready

The pattern is unambiguous: Non-production client IDs work. Production client IDs do not work. This affects every production client ID under my developer account regardless of app configuration.

Has anyone seen this? Is there a developer account level activation step required for production client IDs that I am missing?