Unable to acquire token / Need Help Deploying SPFx Agent to a Single SharePoint Site Only

I have developed an SPFx Application Customizer that hosts a Copilot/Agent sidebar in SharePoint.

Scenario 1: Tenant-Wide Deployment (Works)

When I upload the .sppkg package and select "Enable this app and add it to all sites":

The extension is automatically added to Tenant-Wide Extensions.
I configure the following properties:
Client App ID
Tenant ID
Redirect URL
The bot icon appears in SharePoint.
The agent connects successfully and works as expected.

However, because the deployment is tenant-wide, the bot icon also appears on all other SharePoint sites, which is not my requirement.

Scenario 2: Single Site Deployment (Fails)

When I upload the same .sppkg package and select "Only enable this app":

No entry is created in Tenant-Wide Extensions.
The app is available on the target SharePoint site.
The agent attempts to connect but fails with the error:
Plain Text
Unable to Acquire Token

Show more lines
Troubleshooting Attempted

1. Set skipFeatureDeployment to false
   JSON
   {

"skipFeatureDeployment": false

}

Show more lines

Result: No change.

2. Register the Application Customizer manually using PnP PowerShell
   PowerShell
   Add-PnPCustomAction `

-ClientSideComponentId 4c6e29f2-7eee-4f9f-bbd2-20c8859d0ba2 `

-ClientSideComponentProperties '{"appClientId":"...","tenantId":"...","directConnectUrl":"..."}' `

-Location ClientSideExtension.ApplicationCustomizer `

-Name "SidebarAgent" `

-Title "SidebarAgent" `

-Scope Web

Result: The agent still fails with "Unable to Acquire Token".

Questions
Why does token acquisition work when the extension is deployed tenant-wide but fail when deployed to a single site?
Is there any additional configuration required for site-scoped deployment?
What is the recommended approach to deploy an SPFx Application Customizer/Agent to only one SharePoint site?
Has anyone successfully implemented a single-site deployment for a similar SPFx-based agent?
Expected Behavior

The agent should be available and functional only on the target SharePoint site, without appearing on other sites across the tenant.

Start by comparing the tenant-wide and site-scoped SPFx deployment paths described in the issue, including the manifest setting and the PnP PowerShell custom action. Check how the Client App ID, Tenant ID, and redirect URL are applied in each scope. Done means the agent acquires a token and appears only on the target SharePoint site.