UWP VAPID alternate channels 401

Question

I'm trying to use alternate channels to deliver push notifications to my UWP app. So far, I've got the URI and I've tried to send the push notification using both cURL and pywebpush, but I get a 401 in both cases. I'm using the JS API to get the channel like this:

const pnm = Windows.Networking.PushNotifications.PushNotificationChannelManager.getDefault();
const writer = new Windows.Storage.Streams.DataWriter();
writer.writeString(environment.VAPID_PUBLIC_KEY);
const buffer = writer.detachBuffer();

const notifPromise = pnm.createRawPushNotificationChannelWithAlternateKeyForApplicationAsync(buffer, 'notif');
notifPromise.done(subscription => {
    console.log(subscription);
    subscription.addEventListener('pushnotificationreceived', message => {
        console.log(message);
    });
}

The cURL request returns as

* upload completely sent off: 5 out of 5 bytes
< HTTP/1.1 401 Unauthorized
< Content-Length: 0
< X-WNS-MSG-ID: 1FFF6A946F1C84F4
< X-WNS-DEBUG-TRACE: SG2PEPF00000441
< MS-CV: npI4XUfCt0m9QBptzatEnQ.0
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< WWW-Authenticate: bearer error="invalid_request",error_description="Invalid token"
< Date: Sun, 24 Feb 2019 08:21:00 GMT

where my URI looks like https://sg2p.notify.windows.com/w/?token=BIG_TOKEN and I've the Authorization, TTL and Crypto-Key headers added.

I'm using webpush for notifying browsers and it works fine. Any idea what could be wrong here?