I tried it about 2-3 months ago with trains-init (same use-case as this one) and it failed that time too.

Could it be the credentials are actually incorrect?

Highly unlikely, like I said, I generated a new set of credentials from the Web-UI and it worked perfectly fine for an Azure VM (not under the VPN).