Does the flow you're testing work, at the same time? Or does it fail? It seems to me like oxAuth keys may have expired. Do you have key rotation enabled in this instance? Please check "keyRegenerationEnabled" property on "Configuration -> JSON Configuration -> oxAuth Configuration" page.
Also note that key rotation must only be enabled in stand-alone instances, not clusters (but I suppose you don't use cluster there anyway).