Three hours of debugging and it just so happens none of it was required. Turns out I was using the refresh token instead of the access token for authenticated requests. #NUMPTY