Got it after adding the header: `bearrtoken: logo`.

Without seeing the request code I initially assumed it would be `Authorization: Bearer logo` that did the trick.