I got this error loggin in workbench, after setting up a scratch org (it shows a strange custom domain but I red around forums that it's ok since it can be an old unused org).
I went through the couple of posts that referenced the same issue (related to workbench) but i'm able to do the access to prod only, actually credentials does not work selecting sandbox option. Is there any option to activate? All API / permissions checkbox seem to be okay.
To be sure that the problem is not related to the scratch org, I created a new one (even this one has a custom domain) but the error persists.