I also got this error when implementing a sync_sso call. Using a newly generated API key also fixed it for me.
The cause for me was that I tried to use a Read Only-scoped API key at first. This POST route needs a Global-scoped key.
In hindsight that’s obvious (the route modifies user account details), but this may be good to know for others who are also accidentally using a read-only key.