Figma OAuth Activity Logs Error: “Parameter payload is required”

We have a private OAuth app published to our organization, with redirect URI http://localhost:3000/api/figma/callback and scope org:activity_log_read. We are using the documented authorize URL pattern for the Activity Logs API, but https://www.figma.com/oauth?... immediately returns “Parameter payload is required” before redirecting to our callback.

This happens in a normal browser and blocks OAuth for Activity Logs.