Answer
Check the IAM client configuration backing Report Designer for its allowed redirect URIs — a local-loopback address the desktop tool uses during its sign-in flow needs to be explicitly present in that client's allow-list, and a missing entry there (not a credentials problem) is a common cause of this specific authentication failure.