Did the Oauth requirements not go live?

API
2

Client IDs are public and don’t need to be redacted.

Did you call this using an extension ClientID? Extensions have a little more leeway to update to the new behavious