Hey all,
I fixed in the end by looking at one of the Okta examples online. The error message wasn’t really helpful, the fixed was to swap:
.UseAuthentication()
.UseAuthorization()
I also made sure to use the correct AuthorizationServerId for both the web app and api and set the correct audience value.