OAuth client credentials grant to Web App, get access token succeeds, request to service fails (400)

We are trying to get OAuth client credentials working on a Web App by assigning an Application under Settings and Authentication/Authorization in the Azure Portal.

We have the Daemon-Dotnet sample working (deployed as a Web App).

I created a new web app and console client based on the Daemon-Dotnet sample, but without the OAuth.

We specifically removed:

            app.UseWindowsAzureActiveDirectoryBearerAuthentication(
                new WindowsAzureActiveDirectoryBearerAuthenticationOptions
                {
                    Audience = ConfigurationManager.AppSettings["ida:Audience"],
                    Tenant = ConfigurationManager.AppSettings["ida:Tenant"]
                });

The web app echos the User.Identity.Name property.

I created two applications under my Azure AD (a service and a client). I assigned the permissions as in the sample.

I assigned the service application to the deployed web app.

If I access the api through the web, it redirects me to login, and then the service works and I get my live.com id back as the User.Identity.Name.

In the console app, I am able to get an access token, but when I use that access token to make a request, I receive a 400 bad request error.

The exception is vague, and I'm not sure how to proceed.

Thanks.