Embarrassing to admit, but at least it's a solution, for me at least. The token should be the value of "access_token" in the JSON returned by the call to https://api-m.sandbox.paypal.com/v1/oauth2/token. I was using the entire string! Extracting and using the access_token works. I don't know if the other two people with the problem were doing what I did. Possibly theirs is a different problem.
... View more