checkResponse() was gated on the HTTP status, so a 200 carrying {"error":...} — or no access_token at all — went straight to league's AccessToken constructor and failed there as an InvalidArgumentException. A caller catching IdentityProviderException, as the documentation tells you to, never saw it.
A token endpoint is entitled to report a failure with a 200, and OnPay sometimes does. An error body is now treated as a failure whatever status carries it.
The message is also stringified. IdentityProviderException takes a string, so a body with an array or object where the message belongs turned a failed grant into a TypeError.