Can you post the /authorize call that you made to get the access_token?
I want to make sure that the your used the same authorization server (/oauth2/v1/default) to get the token.
That seems right to me.
I’m not sure what could be the issue here.
Can you also try calling the introspect endpoint with the access_token to make sure the token is valid?