@Viraj Hudlikar 

Thank you for your response. 

I did use the token and the complete callback URL. I just validated the URL again just to make sure that it was still an exact match for the callback URL.

From what I can see, that is the entire process we've followed, we're just getting locked out for some reason. Is there another security location or property that maybe I'm not seeing?