Just a quick update on this case.
The issue was that the application was not granted access to the Management API. In most cases, if the token is opaque, then there was no audience passed into the call. Here is some documentation describing this.
I hope this helps!
Best,
Alex