Trying to obtain access token gives 401 access denied error

The answer is here: Claims doesn't have all the user information

summary: I had to call the API Explorer Application (Machine to Machine) with the relevant client id and secret, not the regular web application.