Using the Salesforce connector with token source END_USER, why might my workflow be able to authenticate with salesforce production org but not the full-copy sandbox?

Using the slack / deno SDK. Line 15:

import { Connectors } from "deno-slack-hub/mod.ts";
//...
 
LogToSalesforce.addStep(
  Connectors.Salesforce.functions.CreateRecord,
  {
    salesforce_object_name: "Task",
    metadata: {
      "Type": "Slack Message",
      "Subject": "Slack conversation with " +
        parsePayloadStep.outputs.real_name,
      "Description": "Message Text: " + parsePayloadStep.outputs.text,
      "Status": "Completed",
    },
    salesforce_access_token: { credential_source: "END_USER" },
  },
);
export default LogToSalesforce;

Works in production, but in the sandbox it makes it far enough for salesforce to log it as successful but returns access_token_exchange_failed