I still maintain that it was confusing, seeing as it’s not obvious that the oauth_receipt endpoint expects anything other than { permissions_received: true } (including an empty payload).
Also, since 2XX response codes are categorically Success reponse codes, I think sending a 204 in this case is misleading: Without a payload the request doesn’t successfully report that OAuth permissions were accepted. Had I gotten a 400 for an empty payload in the first place, I would’ve known that the error was in my code.
All that being said, I do recognize that this is quite a marginal edge case for a very simple endpoint. So I’m just glad it’s working now.
P.S. Long overdue thanks @BarryCarlyon, I’ve picked up many, very valuable techniques and info from your posts on this forum.