Trouble saving annotations and assigning users to groups with third-party authority + JWT (WordPress plugin)

Hi team,

I'm building a WordPress plugin that integrates Hypothesis via JWT, using a third-party authority (myauthority.com in this case - just used for testing, not a real domain). Here's what I'm experiencing:
Context:
I'm using the AuthClient JWT flow to authenticate users automatically via JWT.
Groups (private, open, public) are being created correctly under myauthority.com authority - they show up in my admin dashboard at hypothes.is.
Admin user (with email ctx@myauthority.com, acct:xxx@hypothes.is) is able to:
- see all groups
- annotate and save in all groups
Problem
When a normal user logs in (e.g. acct:user___27@myauthority.com) and we inject:
const groups = ["6xNA4W7J", "oZaaWaoe", "q2pjwmwo"];
- 6xNA4W7J - public group from hypothes.is -> annotations work and save
- oZaaWaoe - open group created under myauthority.com -> annotations UI works, but "Saving annotation failed"
- q2pjwmwo - private group under myauthority.com -> not even visible to user (404 in UI)
When I try to add user to a group manually via API:
Request:
POST /api/groups/oZaaWaoe/members/acct:user___27@myauthority.com
Authorization: Bearer
Content-Type: application/json
Body: {"roles":["member"]}
Response:
{
"error": "HTTP 404",
"body": {
"status": "failure",
"reason": "Either the resource you requested doesn't exist, or you are not currently authorized to see it."
}
}
I'm assuming this means either:
the user doesn't exist (although I created them under myauthority.com), or
the API Key doesn't have permissions on that group.
Extra question:
Normal users authenticated via JWT do not see the "Create group" button in the sidebar UI.
Is there any way to enable this button (even for test purposes)? Or is group creation UI-only available to users under hypothes.is authority?

Environment:
- WordPress custom plugin
- Hypothesis loaded via iframe using:
window.hypothesisConfig = () => ({
services: [{
authority: 'myauthority.com',
grantToken,
groups
}]
});
- JWTs are valid

Thanks for your help - happy to test anything or provide more details if needed!