Fully understand that 
I am just realising the actual problem: the non-descriptive error message.
If it was something like HTTP 403: rate limit reached (max_logins_per_ip), then I’d know where to start debugging.
Now we just had a hunch and changed a random setting somewhere, that seems to have fixed it.