I've solved this by using the ObjectsApi to generate a signed URL and removing the authorisation header from the request.

        ObjectsApi objectsApi = new ObjectsApi(new ClientCredentials(_clientId, _clientSecret));

        var resource = await _ossClient.CreateSignedResourceAsync(bucketKey,
            resultKey,
            new CreateSignedResource(),
            Access.ReadWrite,
            true, accessToken: token.AccessToken);
        
        var outputFileArgument = new XrefTreeArgument()
        {
            Url = resource.SignedUrl,
            Verb = Verb.Put
        };