Why are you using an authorization protocol for authentication? Try OIDC.

OIDC is a layer on top of OAuth...

Yes. But it’s authentication, whereas OAuth is authorization.