python-o365: Unable to fetch auth token. Error: (invalid_client)

Updating a calendar syncing tool I wrote for the new auth system I can’t seem to get it to work. I’ve gone through the app registration steps, I have the app-id and app secret/password with the redirect URL and appropriate graph delegate permissions (superset of scopes list).

I run the script, cut-n-paste the login url into my browser and login. It then redirects me to an outlook.office365.com/owa/ URL which I cut-n-paste back into the terminal at the prompt and I get an error. Script and session copied below.

This is with a freshly created venv using python3.5 (Debian stable) using --system-site-packages and pip installing o365, icalendar and pylint.

Thanks.

import O365 as o365
creds = ('<snip>', '<snip>')
acct = o365.Account(credentials=creds)
scopes = [
    'https://graph.microsoft.com/Calendars.Read',
    'https://graph.microsoft.com/Calendars.Read.Shared',
]
result = acct.authenticate(scopes=scopes)

Running this I get (snipped out anything auth/id related)…

(venv) [~]./test.py
Visit the following url to give consent:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=<snip>&redirect_uri=https%3A%2F%2Foutlook.office365.com%2Fowa%2F&scope=https%3A%2F%2Fgraph.microsoft.com%2FUser.Read+https%3A%2F%2Fgraph.microsoft.com%2FCalendars.Read.Shared+offline_access+https%3A%2F%2Fgraph.microsoft.com%2FCalendars.Read&state=5tUXfvP<snip>&access_type=offline
Paste the authenticated url here: https://outlook.office365.com/owa/?code=OAQABAAIAAACEf<snip>&state=5tUXf<snip>&session_state=f7178db7-<snip>
Unable to fetch auth token. Error: (invalid_client) AADSTS70002: Error validating credentials. AADSTS50012: Invalid client secret is provided.
Trace ID: 6452564a-<snip>
Correlation ID: eaa6da0c-<snip>
Timestamp: 2019-01-14 20:34:12Z
Something go wrong. Please try again.