xero api fails with unauthorized (401 or 403) after calling auth, refresh and gettenants when calling getinvoices – Nginx

I’m a rank noob at this, so excuse my ignorance. I’ve got an MVC web application to login, get the access and refresh tokens, and tenant list OK. I can even get it to refresh the refresh token. No problems.

When I try to run the GetInvoices endpoint either directly or via the sdk, I get 403 (skd) or 401 from the direct api call.

From the latest run with direct call I get this response

{StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: 
System.Net.Http.HttpConnectionResponseContent, Headers:
{
  Server: nginx
  Strict-Transport-Security: max-age=31536000
  WWW-Authenticate: OAuth Realm="api.xero.com"
  Cache-Control: no-store, no-cache, max-age=0
  Pragma: no-cache
  Date: Wed, 21 Jul 2021 11:19:56 GMT
  Connection: close
  X-Client-TLS-ver: tls1.2
  Content-Type: text/html; charset=utf-8
  Content-Length: 95
  Expires: Wed, 21 Jul 2021 11:19:56 GMT
}, Trailing Headers:
{
}}

I know that the access token and tenant id used in the GetInvoices step are correct because I checked them against the values pulled in from the auth steps character by character.

The app is being run in Visual Studio 2019, using the self-signed development SSL certificate.

Why is it rejecting the request?

my controllers have the following

private static readonly string Scopes = "openid offline_access profile email accounting.transactions accounting.contacts accounting.attachments";

        private static readonly string Scopes = "openid offline_access profile email accounting.transactions accounting.contacts accounting.attachments";

            string[] tenant = (string[])TempData.Peek("tenant");
        var client = new HttpClient();

        var formContent = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("summaryOnly", "true"),
        });

        client.DefaultRequestHeaders.Add("Authorization", (string)TempData.Peek("accessToken"));

        client.DefaultRequestHeaders.Add("Xero-Tenant-Id", tenant[0]);

        client.DefaultRequestHeaders.Add("Accept", "application/json");

        var response = await client.PostAsync("https://api.xero.com/api.xro/2.0/Invoices", formContent);