I believe your request payload needs to include json encoded user and password info (I have not tried $ua->credentials).

Your $resp object content should show more details of what the server is expecting.
Try dumping it with Data::Dumper or equivalent.