[BUG] OAuth Flow

# Issue

When following the OAuth Flow in the OAuth Debugger during the token retrieval step I get the following error during the `Exchange Authorization Code` step.
```
"SuperTokens core threw an error for a POST request to path: '/recipe/oauth/token' with status code: 500 and message: java.lang.IllegalArgumentException: Illegal base64 character 20\n"
```
However, when I copy the raw json body and I try to make a POST request to the same endpoint with the same payload in Postman it works as expected. Seems like the `code_verifier` is encoded in some way but not properly decoded afterwards.

# How to reproduce
```
=== OAuth Debugger - Raw Logs ===

[9:30:11 AM] [POST] [200 OK] request_without_token
URL: http://localhost:3000/mcp
Duration: 76ms

Request Headers:
{
"Authorization": "Bearer token",
"Content-Type": "application/json"
}

Request Body:
{
"jsonrpc": "2.0",
"method": "initialize",
"params": {
"protocolVersion": "2025-11-25",
"capabilities": {},
"clientInfo": {
"name": "MCPJam Inspector",
"version": "1.0.0"
}
},
"id": 1
}

Response Headers:
{
"cache-control": "no-cache",
"connection": "keep-alive",
"content-length": "226",
"content-type": "text/event-stream",
"date": "Thu, 05 Mar 2026 08:30:11 GMT",
"x-powered-by": "Express"
}

Response Body:
{
"transport": "sse",
"events": [
{
"event": "message",
"data": {
"result": {
"protocolVersion": "2025-11-25",
"capabilities": {
"resources": {
"listChanged": true
},
"tools": {
"listChanged": true
}
},
"serverInfo": {
"name": "chift-datalayer",
"version": "0.1.0"
}
},
"jsonrpc": "2.0",
"id": 1
}
}
],
"isOldTransport": false,
"endpoint": null,
"mcpResponse": {
"result": {
"protocolVersion": "2025-11-25",
"capabilities": {
"resources": {
"listChanged": true
},
"tools": {
"listChanged": true
}
},
"serverInfo": {
"name": "chift-datalayer",
"version": "0.1.0"
}
},
"jsonrpc": "2.0",
"id": 1
},
"rawBuffer": ""
}

[9:30:11 AM] [INFO] received_401_unauthorized
Optional Authentication Detected
{
"message": "Server allows anonymous access",
"note": "Proceeding with OAuth discovery for authenticated features"
}

[9:30:12 AM] [GET] [200 OK] request_resource_metadata
URL: http://localhost:3000/.well-known/oauth-protected-resource/mcp
Duration: 6ms

Request Headers:
{
"Authorization": "Bearer token",
"MCP-Protocol-Version": "2025-11-25"
}

Response Headers:
{
"access-control-allow-origin": "*",
"connection": "keep-alive",
"content-length": "101",
"content-type": "application/json; charset=utf-8",
"date": "Thu, 05 Mar 2026 08:30:12 GMT",
"etag": "W/\"65-1qfcHJdBDV3myUNAjLqFSOETWlU\"",
"keep-alive": "timeout=5",
"x-powered-by": "Express"
}

Response Body:
{
"resource": "http://localhost:3000/mcp",
"authorization_servers": [
"http://chift.localhost:4000/auth"
]
}

[9:30:12 AM] [INFO] received_resource_metadata
Authorization Servers
{
"Resource": "http://localhost:3000/mcp",
"Authorization Servers": [
"http://chift.localhost:4000/auth"
]
}

[9:30:12 AM] [GET] [200 OK] request_authorization_server_metadata
URL: http://chift.localhost:4000/auth/.well-known/openid-configuration
Duration: 103ms

Request Headers:
{
"Authorization": "Bearer token"
}

Response Headers:
{
"access-control-allow-origin": "*",
"connection": "keep-alive",
"content-language": "en",
"content-length": "734",
"content-security-policy": "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/gh/supertokens/;img-src 'self' https://cdn.jsdelivr.net/gh/supertokens/ https://purecatamphetamine.github.io/;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests",
"content-type": "application/json; charset=utf-8",
"cross-origin-opener-policy": "same-origin",
"cross-origin-resource-policy": "same-origin",
"date": "Thu, 05 Mar 2026 08:30:12 GMT",
"keep-alive": "timeout=5",
"origin-agent-cluster": "?1",
"referrer-policy": "no-referrer",
"strict-transport-security": "max-age=31536000; includeSubDomains",
"vary": "Accept-Encoding",
"x-content-type-options": "nosniff",
"x-dns-prefetch-control": "off",
"x-download-options": "noopen",
"x-frame-options": "SAMEORIGIN",
"x-permitted-cross-domain-policies": "none",
"x-xss-protection": "0"
}

Response Body:
{
"issuer": "http://chift.localhost:4000/auth",
"jwks_uri": "http://chift.localhost:4000/auth/jwt/jwks.json",
"authorization_endpoint": "http://chift.localhost:4000/auth/oauth/auth",
"token_endpoint": "http://chift.localhost:4000/auth/oauth/token",
"userinfo_endpoint": "http://chift.localhost:4000/auth/oauth/userinfo",
"revocation_endpoint": "http://chift.localhost:4000/auth/oauth/revoke",
"token_introspection_endpoint": "http://chift.localhost:4000/auth/oauth/introspect",
"end_session_endpoint": "http://chift.localhost:4000/auth/oauth/end_session",
"subject_types_supported": [
"public"
],
"id_token_signing_alg_values_supported": [
"RS256"
],
"response_types_supported": [
"code",
"id_token",
"id_token token"
],
"code_challenge_methods_supported": [
"S256"
]
}

[9:30:12 AM] [INFO] received_authorization_server_metadata
Authorization Server Metadata
{
"Issuer": "http://chift.localhost:4000/auth",
"Authorization Endpoint": "http://chift.localhost:4000/auth/oauth/auth",
"Token Endpoint": "http://chift.localhost:4000/auth/oauth/token",
"PKCE Methods": [
"S256"
],
"Response Types": [
"code",
"id_token",
"id_token token"
]
}

[9:30:13 AM] [INFO] received_client_credentials
Pre-registered Client
{
"Client ID": "stcl_babfe50b-e56a-49e8-b065-34d4435fb2cf",
"Client Secret": "Configured",
"Token Auth Method": "client_secret_post",
"Note": "Using pre-registered client credentials from server config (skipped DCR)"
}

[9:30:14 AM] [INFO] generate_pkce_parameters
Generate PKCE Parameters
{
"code_challenge": "1jhqLmwTdIxoIcxwSJar_Jr8bdYVvqROzT7l73d_8Yc",
"method": "S256",
"resource": "http://localhost:3000/mcp"
}

[9:30:14 AM] [INFO] authorization_request
Authorization URL
{
"url": "http://chift.localhost:4000/auth/oauth/auth?response_type=code&client_id=stcl_babfe50b-e56a-49e8-b065-34d4435fb2cf&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback%2Fdebug&code_challenge=1jhqLmwTdIxoIcxwSJar_Jr8bdYVvqROzT7l73d_8Yc&code_challenge_method=S256&state=A0uhunp.4cTadPaw&resource=http%3A%2F%2Flocalhost%3A3000%2Fmcp"
}

[9:30:23 AM] [POST] [500 Internal Server Error] token_request
URL: http://chift.localhost:4000/auth/oauth/token
Duration: 108ms

Request Headers:
{
"Content-Type": "application/x-www-form-urlencoded"
}

Request Body:
{
"grant_type": "authorization_code",
"code": "st_ac_yAKOj6EHs1tBdG0kamc3ScEkfienNR8GjYvjEmCB0kU.kZZGE1a_lTifKEAzHve6yaFE72XtW0_ArF37_swNeVc",
"redirect_uri": "http://localhost:6274/oauth/callback/debug",
"client_id": "stcl_babfe50b-e56a-49e8-b065-34d4435fb2cf",
"client_secret": "7gz_ITb9NPx5gtGwn9UDAdwsXB",
"code_verifier": "mabPPmvvU6OQ8HjMNW2ToN-lxurocvRN~prpaAuvtPJ",
"resource": "http://localhost:3000/mcp"
}

Response Headers:
{
"access-control-allow-credentials": "true",
"access-control-allow-headers": "X-Requested-With,content-type",
"access-control-allow-methods": "GET, POST, OPTIONS, PUT, PATCH, DELETE",
"access-control-expose-headers": "RateLimit-Reset",
"connection": "keep-alive",
"content-language": "en",
"content-length": "196",
"content-security-policy": "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/gh/supertokens/;img-src 'self' https://cdn.jsdelivr.net/gh/supertokens/ https://purecatamphetamine.github.io/;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests",
"content-type": "application/json; charset=utf-8",
"cross-origin-opener-policy": "same-origin",
"cross-origin-resource-policy": "same-origin",
"date": "Thu, 05 Mar 2026 08:30:23 GMT",
"keep-alive": "timeout=5",
"origin-agent-cluster": "?1",
"referrer-policy": "no-referrer",
"strict-transport-security": "max-age=31536000; includeSubDomains",
"vary": "Accept-Encoding",
"x-content-type-options": "nosniff",
"x-dns-prefetch-control": "off",
"x-download-options": "noopen",
"x-frame-options": "SAMEORIGIN",
"x-permitted-cross-domain-policies": "none",
"x-xss-protection": "0"
}

Response Body:
{
"message": "SuperTokens core threw an error for a POST request to path: '/recipe/oauth/token' with status code: 500 and message: java.lang.IllegalArgumentException: Illegal base64 character 20\n"
}

```

# Expected Behavior

It should retrieve the access_token

# Platform

- Mac App

# Additional Context

Add any other context about the problem here.