I just want to update that I fixed the problem. It was a terribly dumb mistake. I was debugging and testing this locally (localhost), but my redirect_uri in GCP was pointing to my production domain, and that was why the flow broke and I was getting null.

Thanks Doug Stevenson for helping bring some clarity to my thought process too. Appreciate it!