by Peter Lefferts.
Thanks Mary- I posted here but then found the problem when attempting to reproduce the issue on a new moodlecloud domain.
https://tracker.moodle.org/browse/CLOUD-4
Please close this bug- the problem turned out to be that the course external tool configuration can override the consumer secret field, and it had auto-populated with a random value.