You're attempting to use the email address and password for a sandbox account for an API-based solution, which requires API credentials to work correctly. In this specific case, you will need the "client_id" and "client_secret" from a sandbox REST application to request an access token.
(note : There is an active issue where accessing the REST apps & credentials page returns a HTTP 500 error. We're working on this issue, check the thread pinned at the top of this forum to see when the issue is resolved)
Once you have the REST credentials, you can submit an access token request :