App Bridge v2 required host parameter is missing from the OAuth confirmation redirect's query string

You can find host here:

https://example.org/some/redirect/uri?code={authorization_code}&hmac=da9d83c171400a41f8db91a950508985&host={base64_encoded_hostname}&timestamp=1409617544&state={nonce}&shop={shop_origin}

use it to create your hmac to compare to Shopify’s (code, host, shop, state, timestamp)