Why am I receiving 400 Bad Request errors when creating a delegate access token?

It seems that delegate_access_scope expects a list of access_scopes, so you would need to change its value to [‘read_products’]

const shop = req.query.shop
const {accessToken} = await Shopify.Utils.loadOfflineSession(shop)

fetch(`https://${shop}/admin/access_tokens/delegate.json`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Shopify-Access-Token': accessToken
  },
  body: JSON.stringify({
    delegate_access_scope: ['read_products']
  })
})
.then(result => console.log(result))