So I solved this. (read, narrowed it down) Apparently, the api tokens created on the PROJECT page are completely ignored by the system, (unless you are already logged in, then it doesn’t care and 'just works’™
APIs created in the USER page? Work flawlessly.
So now a question: what the heck are the API Permission tokens on the project settings page for? Besides testing if you can read the docs correctly at anytime other then 5am?