An API call works in the browser but fails from a script

The browser was not making the same request. It sent the session cookie of whoever was signed in, often an administrator, and the script sends nothing, or something else. Read the status first: 401 means no credential was found, and 403 means one was found and refused.

• 401 from the script. It sends no credential. Send Authorization: Bearer with an OAuth access token for a backend user made for the integration, or that user's API key, the older option. Never copy a browser's cookie into a script.
• 403, "Token doesn't exist or is not valid". The OAuth access token has expired, after four hours, or was never issued here: refresh it.
• 403, "Authorization method not supported". The scheme must be written exactly Bearer or Basic. bearer and Token are refused.
• 403, "Authentication failed". The API key does not exist on this environment. Keys are stored per environment, so a staging key does not work on production.
• Works for your admin login, fails for the integration's credential. Its user has fewer permissions, or an API key has an IP list that does not include the server's address.
• A write fails from a script that sends a session cookie. A cookie-authenticated POST, PUT or DELETE needs the CSRF token as X-Csrf-Token. With an Authorization header the check does not apply.
• The browser test was signed in as an administrator, and the real caller is a member. A member is refused on everything except the visitor routes.
• The script runs in a browser on another domain. The platform sends no cross-origin headers, so a page on another domain cannot read the response at all. Call the API from your server.

-i prints the status and headers. On a 401 with an empty body, the x-reason header says why. Which credential suits which client: choosing one.