DoAuthorization returns "Permission denied" error – Ebay API

We’re developing a marketplace where buyers and sellers meet to trade (something similar to Ebay). We want to support paying via PayPal and we don’t intend to take any service fees. Since we’re a startup any overhead paperwork for us is excess so we’ve decided that any PayPal transaction is between buyers and sellers directly.

However, we want to have accept/deny mechanism for sellers so they have to manually approve each and every order (in case some items are out of stock in their physical store etc.). After order is accepted, money should be transferred to the seller.

After a lot of thinking and reading PayPal documentation, we’ve decided to go with Express Checkout using auth/capture and parallel payment concepts. We’ve successfully integrated Express Checkout and everything works until calling DoAuthorization API which unfortunately fails. Everything we’ve done so far is inside PayPal Sandbox.

To give you a picture how our communication with PayPal’s endpoint works, here is what we’re doing (only important fields will be shown):

1. call SetExpressCheckout having PAYMENTREQUEST_0_PAYMENTACTION=Order and PAYMENTREQUEST_0_SELLERPAYPALACCOUNTID={seller's PayPal email address}
2. redirect buyer to RedirectURL to authorize payment
3. call GetExpressCheckoutDetails to get info about payment
4. call DoExpressCheckoutPayment having PAYMENTREQUEST_0_PAYMENTACTION=Order

Here we got info about transaction with status “Pending” which seems that everything is OK up to this point (transaction is also visible in the seller’s PayPal account with the status “Pending”). Now according to documentation available we need to call DoAuthorization in order to complete auth process. However, after calling DoAuthorization we’re facing an error saying:

[L_ERRORCODE] => 10007
[L_SHORTMESSAGE] => Permission denied
[L_LONGMESSAGE] => You do not have permissions to make this API call
[L_SEVERITYCODE] => Error

Here is what we’re sending and receiving with DoExpressCheckoutPayment and DoAuthorization API calls (only important sections will be displayed):

DoExpressCheckoutPayment

Request

[REQUESTDATA] => Array
    (
        [USER] => {our API username}
        [PWD] => {our API password}
        [VERSION] => 98.0
        [BUTTONSOURCE] => AngellEYE_PHPClass
        [SIGNATURE] => {our API signature}
        [METHOD] => DoExpressCheckoutPayment
        [TOKEN] => {token we got from SetExpressCheckout}
        [PAYERID] => {payer ID we got from GetExpressCheckoutDetails}
        [RETURNFMFDETAILS] => 1
        [NOSHIPPING] => 1
        [PAYMENTREQUEST_0_AMT] => 123
        [PAYMENTREQUEST_0_ITEMAMT] => 23
        [PAYMENTREQUEST_0_SHIPPINGAMT] => 100
        [PAYMENTREQUEST_0_CURRENCYCODE] => EUR
        [PAYMENTREQUEST_0_DESC] => Order #54
        [PAYMENTREQUEST_0_SELLERPAYPALACCOUNTID] => {seller's PayPal email address}
        [PAYMENTREQUEST_0_PAYMENTACTION] => Order
    )

Response

[PAYMENTS] => Array
    (
        [0] => Array
            (
                [TRANSACTIONID] => {we get some transaction ID here}
                [TRANSACTIONTYPE] => expresscheckout
                [PAYMENTTYPE] => None
                [ORDERTIME] => 2014-01-15T22:43:19Z
                [AMT] => 123.00
                [FEEAMT] =>
                [SETTLEAMT] =>
                [TAXAMT] => 0.00
                [EXCHANGERATE] =>
                [CURRENCYCODE] => EUR
                [PAYMENTSTATUS] => Pending
                [PENDINGREASON] => order
                [REASONCODE] => None
                [PROTECTIONELIGIBILITY] => None
                [ERRORCODE] => 0
            )
    )

DoAuthorization

Request

[REQUESTDATA] => Array
    (
        [USER] => {our API username}
        [PWD] => {our API password}
        [VERSION] => 98.0
        [BUTTONSOURCE] => AngellEYE_PHPClass
        [SIGNATURE] => {our API signature}
        [METHOD] => DoAuthorization
        [TRANSACTIONID] => {transaction ID we got from DoExpressCheckoutPayment}
        [AMT] => 123
        [CURRENCYCODE] => EUR
    )

Response

[ERRORS] => Array
    (
        [0] => Array
            (
                [L_ERRORCODE] => 10007
                [L_SHORTMESSAGE] => Permission denied
                [L_LONGMESSAGE] => You do not have permissions to make this API call
                [L_SEVERITYCODE] => Error
            )
    )

After spending a week trying to get this to work, googling and going through all available documentation trying to find if we have to have permissions to call DoAuthorization API, we’re clueless.
We’re sorry if this question is too long but we wanted you to have the full picture on what’s going on and how we handle things with PayPal API. If knowledgable person could shed some light onto this issue, we’d be thankful.