The documentation says that this is optional. But not in my case.
Can you elaborate on where you found this in the doc?
The error should say missing "X-FusionAuth-TenantId"
Can you elaborate on this?
When I get back the "code" do I need to manually convert it to a token, or is this done automatically?
You may want to review our OAuth guide. Using a OAuth2 flow, it is common to have two separate endpoints (authorize and token) to obtain access. The "code" is returned from FusionAuth and is used (in conjunction with a few other possible factors) to obtain an access token (in our typescript client, this is the client.exchangeOAuthCodeForAccessTokenUsingPKCE function)
We do have a few tutorials as well, that show this in action (nodeJS tutorial being one of them)
Lastly, for general housekeeping's sake, this thread is getting a bit long, with a few related posts clumped together. For future questions, if the question is unrelated to the posts immediately above, it might be good to open a new thread.