Thank you @Sandeep Bandaru for your help yesterday.
It seems like the root cause of the issue was that the app registration was not configured correctly to work with the intended account.
We took the following steps to resolve the issue:
- Created a new App Registration from the Partner Center from the production account (Developer settings, Users, Add Azure AD Application, New Azure AD Application)
- We used the new credentials (client id and secret) when requesting the token from the API:
- We used the token in the request against the Partner Center API