After a lot of trial and error, it suddenly worked... The only difference we can find is that we created a new client secret for the ClientId.

So our assumption is that secrets created (and used?) before the OAuth App is approved won't work, even after the app is approved.