Getting an error logging in with IdP in authorization code grant flow

I'm trying to add an identity provider (Okta) to my user pool. I've been able to get the implicit grant flow working for one app client in my pool.

Now I've set up a new app client for the authorization code grant flow in order to support OAuth access to my API.

What I'm seeing is that after redirecting to the cognito oauth2/authorize endpoint, it correctly redirects to the hosted login that allows me to select the identity provider. When I log in through the identity provider, it redirects me back to the hosted login page and displays an error message saying "Something went wrong. Please try again."

I have both the identity provider and the user pool set up for this client. If I log in using username/password to the user pool, it works as expected.

So now I have some questions:

1. Is this a supported configuration - is it possible to use an IdP with the authorization code grant flow?
2. How can I find out more about what's going wrong - the error message is not helpful for debugging