Insufficient scope error while scope is correct

[sfdb]

Description

I'm consistently getting an "Insufficient scope" error when trying to export the order data using the CLI export tool. The command I'm using is:

order-export --projectKey <project-key> --accessToken <access-token> --targetDir c:/tmp --logDir c:/tmp --csvTemplate c:/tmp/header.txt

This is working fine for the customer-export using the same project-key and access token. The scope is configured correctly in Commercetools: the credentials have read-only access to all entities (including customer and order).

Expected Behavior

Create a local order export for the specified project key.

Current Behavior

Receiving an Insufficient scope error. This is the case when providing only an access key, only client-id and client-secret, and when providing all three. The same behavior occurs when using credentials that have manage-orders access. Also specifying the sphereHost and/or sphereAuthHost do not help. Exporting the orders using the Impex tool also works fine.

Stacktrace

{
	"name": "sphere-order-export-2.2.3",
	"hostname": "<hostname>",
	"pid": 17576,
	"level": 50,
	"data": {
		"body": {
			"statusCode": 403,
			"message": "Insufficient scope",
			"errors": [{
				"code": "insufficient_scope",
				"message": "Insufficient scope"
			}],
			"error": "insufficient_scope",
			"error_description": "Insufficient scope",
			"originalRequest": {
				"endpoint": "/channels",
				"payload": {
					"key": "OrderXmlFileExport",
					"roles": ["OrderExport"]
				},
				"options": {
					"config": {
						"project_key": "<project-key>"
					},
					"host": "api.sphere.io",
					"protocol": "https",
					"timeout": 60000,
					"rejectUnauthorized": true,
					"headers": {
						"User-Agent": "sphere-order-export - 2.2.3",
						"Authorization": "Bearer <token>"
					},
					"uri": "https://api.sphere.io/<project-key>",
					"gzipEnable": true
				}
			}
		},
		"message": "Forbidden",
		"name": "HttpError",
		"stack": "HttpError: Forbidden\n    at <root>\\Roaming\\npm\\node_modules\\sphere-order-export\\node_modules\\sphere-node-sdk\\lib\\services\\base.js:518:22\n    at ChannelService.BaseService._wrapResponse (<root>\\Roaming\\npm\\node_modules\\sphere-order-export\\node_modules\\sphere-node-sdk\\lib\\services\\base.js:523:11)\n    at <root>\\Roaming\\npm\\node_modules\\sphere-order-export\\node_modules\\sphere-node-sdk\\lib\\services\\base.js:400:40\n    at Request._callback (<root>\\Roaming\\npm\\node_modules\\sphere-order-export\\node_modules\\sphere-node-sdk\\lib\\connect\\rest.js:166:14)\n    at Request.self.callback (<root>\\Roaming\\npm\\node_modules\\sphere-order-export\\node_modules\\request\\request.js:185:22)\n    at Request.emit (events.js:203:13)\n    at Request.<anonymous> (<root>\\Roaming\\npm\\node_modules\\sphere-order-export\\node_modules\\request\\request.js:1161:10)\n    at Request.emit (events.js:203:13)\n    at Gunzip.<anonymous> (<root>\\Roaming\\npm\\node_modules\\sphere-order-export\\node_modules\\request\\request.js:1083:12)\n    at Object.onceWrapper (events.js:291:20)\n    at Gunzip.emit (events.js:208:15)\n    at endReadableNT (_stream_readable.js:1168:12)\n    at processTicksAndRejections (internal/process/task_queues.js:77:11)",
		"code": 403,
		"statusCode": 403
	},
	"project_key": "<project-key>",
	"msg": "Oops, something went wrong!",
	"time": "2019-09-23T09:01:36.048Z",
	"v": 0
}

Using sphere-order-export version 2.2.3.