Cannot send a Toast Notification through Notification Hub Error: The Token obtained from the Token Provider is wrong

I have set up a Notification Hub and have configured my app as described in this tutorial: https://learn.microsoft.com/en-us/azure/notification-hubs/notification-hubs-windows-store-dotnet-get-started-wns-push-notification . I have configured the app through the store & entered the config values in Notification Hub. I have double & triple checked that the values are accurate. In my app I register with Azure tike this:

            var channel = await PushNotificationChannelManager.CreatePushNotificationChannelForApplicationAsync();
            var hub = new NotificationHub(Secrets.HubName, Secrets.HubConnectionString);
            channelID = channel.Uri;
            var _date = DateTime.Now.ToString();
            var result = await hub.RegisterNativeAsync(channelID);
            string registraionID = result.RegistrationId;	

The app becomes registered & I get a registratioID back. But when I attempt to send a toast test message using the toast format provided by the Azure Hub

<?xml version="1.0" encoding="utf-8"?>
<toast>
<visual><binding template="ToastText01">
<text id="1">Test message</text>
</binding>
</visual>
</toast>

I get the error: The Token obtained from the Token Provider is wrong. All searches imply that this error refers to the fact that the credentials do not match between the application & the HUB. But I assure you that they do match. I have checked for typo's or wrong entries and have painstakingly assured that credential are in sync.

I have used external tools like Powershell to retrieve an token and send a notification directly to WNS and it fails to authenticate. I have used this method in my test app to retrieve credentials and I get a token back successfully:

        private static async Task<string> GetWnsAccessToken(string sid, string secret)
        {
            string _date = DateTime.Now.ToString();
            using (var client = new HttpClient())
            {
                var body = $"grant_type=client_credentials&client_id={Uri.EscapeDataString(sid)}&client_secret={Uri.EscapeDataString(secret)}&scope=notify.windows.com";
                var content = new StringContent(body, Encoding.UTF8, "application/x-www-form-urlencoded");
                var response = await client.PostAsync("https://login.live.com/accesstoken.srf", content);
                try
                {
                    var glh = response.EnsureSuccessStatusCode();
                    if (!glh.IsSuccessStatusCode)
                    {
                        File.AppendAllText("WnsLog.txt", $"{_date}: GetWnsAccessToken-Failed Getting token:\n {glh.StatusCode}\n");
                    }
                }
                catch(Exception ex)
                {
                    File.AppendAllText("WnsLog.txt", $"{_date}: GetWnsAccessToken-Error Getting token:\n {ex.Message}\n");
                }
                var json = await response.Content.ReadAsStringAsync();
                using var doc = System.Text.Json.JsonDocument.Parse(json);
                return doc.RootElement.GetProperty("access_token").GetString();
            }
        }

But when it's used it is rejected "Forbidden".

The only thing that seems to be not in sync, but all instructions, and validations imply it should be this way is the Package SID. Notification Hub Settings requires the SID to be prepended with 'ms-app://'. Where as in the Partner Center the SID has no such prefix. Is this an issue?

Where should I be looking to solve this? Is there some undocumented item that I'm missing. Any help would be appreciated.