Yep, following the instructions for both the auth endpoints and the authorizer for my api did the trick. Just wanted to follow up here in case anyone else had the same misunderstanding I did.