PKCE code_verifier mismatch on Genesys Cloud SSO

Implementing the Authorization Code flow with PKCE for a SPA and hitting a 400 Bad Request on /oauth/token. The error is ‘invalid_grant: invalid authorization code’. I’m passing the code_verifier generated from the challenge, but it keeps failing. Checked the base64url encoding logic multiple times and it looks correct. Any idea if the Genesys Cloud auth endpoint requires a specific transformation on the verifier?