Yeah sadly I apparently noted this absolutely nowhere, but I think it was okta who failed if there was no nonce? One of okta and auth0 definitely did.    I have to say it annoys me a lot that I lost this info.