The 400 code is a generic one for Bad Request, but Amazon usually sends more information in the response itself. If the page in the uri_direct is one you own and can modify, you can try to add code to it to show the message that's sent in the response.
I whitelisted the following url :
https://roscasend.go.ro/ and ì used for redirect_uri the following url
https://roscasend.go.ro and for that reason I encountered the bad request error. I updated the redirect_uri to be the same as the allowed origin url from the web settings tab of the security profile and it worked.