I'm trying to block a user using ApiSandbox. I've filled the fields, got a csrf token, and always get the following:

{
    "servedby": "mw1204",
    "error": {
        "code": "badtoken",
        "info": "Invalid token",
        "*": "See https://meta.wikimedia.org/w/api.php for API usage"
    }
}

I've tried to get other csrf token, but the same error always repeat.

• Request URL: /w/api.php?action=block&format=json
• POST data: user=SophieBecnel&expiry=never&reason=spamming&nocreate=&autoblock=&token=bcfcd339f1878646a062b5735467bffc553eb854%2B%5C%5C