I missed a step where I needed to generate an rsa key pair for prod. You cannot use the one from demo. After that I then needed to grant consent to my prod user as I had done in demo as the next error was "consent_required"

See: https://community.docusign.com/authentication-67/invalid-grant-no-valid-keys-or-signatures-4105 which covers both issues

and

https://developers.docusign.com/platform/auth/authcode/confidential-authcode-get-token/?_gl=1*2tmryc*_gcl_aw*R0NMLjE3MzYyOTI1NTYuQ2owS0NRaUF2dk83QmhDLUFSSXNBR0Z5VG9YMzc3WUs3VGNyMHlWN0pPTTUyaldNMXJUX0pmc3ZDVGdwOXcwWkxndENCQU4yc3k5b2J4NGFBdE5KRUFMd193Y0I.*_gcl_au*MTI0MTc0NDYxNC4xNzM5MDQxODY3