I'm not happy about spending all day on this issue, but here's the solution I had.
I revoked the application I had made from the user, then I deleted the credentials stored from my database.
I'm sure I'd already done that as a first step, but apparently not.
There's 10 hours of my life I won't get back. Hope this is useful to someone.