INSUFFICIENT_SCOPES driving me crazy (in sandbox)

deleting this post as I just realized after much wasted time that it wasn’t properly passing in the scope in the auth url, it was empty. ugh.