Changing Azure AD Authority from /tenantID to /common causes 401 - azure

Question

I have a Blazor WASM Azure static web app that communicates with an Azure AD protected API running on ASP.NET Core. I had setup Microsoft Account and one-time passcode IDPs.
I could sign in and call protected endpoints on my API - only when signed in - until I had my first Microsoft Account that wasn't in the tenant. They got AADSTS50020. The only cause that applied to me was cause 2 (used the wrong endpoint), so I changed my authority from https://login.microsoftonline.com/<YourTenantNameOrID> to https://login.microsoftonline.com/common according to that help page and this documentation.
Now every user can sign but we all get 401 unauthorized on protected endpoints.
The WWW-Authenticate header is set to Bearer error="invalid_token", error_description="The signature is invalid".
I obviously haven't "tried everything" if one simple change causes everything to break, but I've pored over documentation these past couple days to no avail.
Notes:
The one-time passcode sign-in option went away, and my main MS account is never auto-suggested even though I use it every time.
My tokens "look" fine, the aud is the API client id and the 1 necessary scope is present in scp.
API manifest
...
"oauth2AllowIdTokenImplicitFlow": true,
"oauth2AllowImplicitFlow": false,
...
"oauth2Permissions": [
{
"adminConsentDescription": "Allows the app to access the web API on behalf of the signed-in user",
"adminConsentDisplayName": "Access the API on behalf of a user",
"id": "<access_as_user scope id>",
"isEnabled": true,
"lang": null,
"origin": "Application",
"type": "User",
"userConsentDescription": "Allows this app to access the web API on your behalf",
"userConsentDisplayName": "Access the API on your behalf",
"value": "access_as_user"
}
],
...
"signInAudience": "AzureADandPersonalMicrosoftAccount",
...
Client manifest
...
"oauth2AllowIdTokenImplicitFlow": true,
"oauth2AllowImplicitFlow": true,
...
"requiredResourceAccess": [
...
{
"resourceAppId": "<api client id>",
"resourceAccess": [
{
"id": "<access_as_user scope id>",
"type": "Scope"
}
]
}
],
...
"signInAudience": "AzureADandPersonalMicrosoftAccount",
...
I can provide additional information, such as configuration code, but I didn't want to start out making the question too long.

Answer 1

Well, the rule of finding the answer shortly after posting on a help board relative to the time spent searching for the answer before posting on the help board reigns supreme.
For anyone who has the same question, my TenantId configuration on my API was set to my actual tenant id. Even if your client requests a token from the common endpoint, your API needs tenant set to common too.
See more:
https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-app-configuration