API Gateway jwt authorizer OIDC discovery endpoint

Hi all,

I need to setup an API Gateway JWT authorizer using Okta as provider.
Unfortunately the issuer is not directly accessible and I have to whitelist its URLs.
I have whitelisted:
https://okta-domain/.well-known/openid-configuration
https://okta-domain/.well-known/oauth-authorization-server
https://okta-domain/v1/keys

but it seems it is not enough as accessing I still get:
www-authenticate: Bearer scope="" error="invalid_token" error_description="non-200 status code received from OIDC discovery endpoint"

Do you know which other URLs do I need to whitelist?

Thanks!