indieweb_indieauth - not working with indielogin.com

Problem/Motivation

Attempting to set my site up as an authentication provider for IndieWeb
Getting a "Missing or invalid parameters to obtain code: me is empty" error

Steps to reproduce

1. I setup the IndieAuth module to expose my Drupal 11 site as an authentication provider.
2. Verified that my site exposes the authorization and token endpoints in the html head
3. I setup all of the "rel=me" stuff and my site passes the tests on https://indiewebify.me/
4. When I go to https://indielogin.com and enter my Drupal site URL it redirects me back to the authentication endpoint.
5. I click the Authorize button and it redirects me back to indielogin.com with this query string

https://indielogin.com/redirect/indieauth?
state=b8a81a98f32f53a427396d57&
me=https://paullieberman.net/
&code=hflVnH7kI - Truncated

So the Drupal server is indeed sending back an authorization code, and the "me" parameter.

However when indielogin.com goes back to get the token I get.

{
    "error": "invalid_request",
    "error_description": "Missing or invalid parameters"
}

Checking the Drupal log it is a bit more specific.
"Missing or invalid parameters to obtain code: me is empty"

Identified the error is happening when indielogin.com makes the token request post. This post does not have a me parameter, yet the IndieAuthController insists on having one. Here is the token request post -

POST /indieauth/token HTTP/1.1 Accept: application/json Content-Length: 379  
Content-Type: application/x-www-form-urlencoded 
Host: paullieberman.net User-Agent: indielogin.com X-Php-Ob-Level: 1 

grant_type=authorization_code
&code=cC7mvwt4Ognf4 - truncated
&client_id=https%3A%2F%2Findielogin.com%2Fid
&redirect_uri=https%3A%2F%2Findielogin.com%2Fredirect%2Findieauth
&code_verifier=6931e4e67c - truncated

I attempted in vain to hack IndieAuthController.php to make it work without the 'me' parameter, hoping to be able to send you a diff, but even when I bypassed the checks for the 'me' parameter I could not make it work. Sorry

Proposed resolution

Honestly I'm not sure what the best resolution is. The Spec appears to say that your code is correct in expecting the "me" parameter.

"6.3.2 Authorization Code Verification
The token endpoint needs to verify that the authorization code is valid, and that it was issued for the matching me, client_id and redirect_uri, and contains at least one scope."

However one would tend to believe that indielogin.com is doing the right thing.

I tried to get help on the IndieWeb Slack/Discord channel where I got a lot diagnosing the problem, but not solving it. Other people said they have their own sites working as authentication providers for indielogin.com, but none of them are using Drupal.

See also: https://indieauth.spec.indieweb.org/#authorization-request-p-11 (from #3192219: Update to latest IndieAuth spec)