A HTTP401 on /token is returned if the client_id/secret aren’t recognized 
(either the wrong credentials for the environment, or the credentials aren’t 
active).

Can you run a test via cURL to rule out any environment / code-specific issues?

curl -v -u "client_id:secret" "https://api.sandbox.paypal.com/v1/oauth2/token" -X POST -d