The scope in the token generation is different form the scope you're validating against. That's most likely the issue.
Check what @juunas commented.