I wonder if it’s because of the missing prompt param to none in the auth URL?
promptcontrols how the authorization flow handles existing authorizations. If a user has previously authorized your application with the requested scopes and prompt is set toconsent, it will request them to reapprove their authorization. If set tonone, it will skip the authorization screen and redirect them back to your redirect URI without requesting their authorization