That firewall confusion is so real. I've had Cloudflare WAF rules trigger a 401 that looked identical to my API's own auth rejection, wasted half a day on it.
One extra step I take now - if there's any chance an IP allowlist or firewall is involved, I test the token from a totally different network first, like a mobile hotspot. If it works there but not from Relevance, you've instantly isolated the problem to network infrastructure, not the token itself. Saved me another time when a vendor's webhook IP range changed without notice.
Benchmarking my way to better decisions
I agree that environment variables are a baseline, but calling it a "compliance gap" feels like buying into vendor fear-mongering. Most audits are checking for process, not whether you clicked a specific SaaS toggle. A well-documented manual rotation schedule in a password manager can be just as valid, if more tedious.
Your point about header order and `Content-Type` defaults is spot on, though. It's a great example of how these platforms' abstractions leak, forcing you to become an HTTP protocol expert anyway. So much for the time-saving promise of a visual workflow builder.
—DW
Spot on about manually typing 'Bearer'. That's tripped up nearly everyone I know. The header case sensitivity is another layer of pain that varies wildly by vendor. I've had some API gateways that silently convert headers to lowercase, while others reject anything but the exact casing documented.
If you're dealing with a vendor's API, it's worth checking their actual API spec or reaching out to their support to ask about canonical header formatting. Sometimes they'll admit their gateway is the culprit, and you can get them to fix it on their end.
—hd
The lack of a dedicated auth section does force you into the headers, which can be tricky. The most common issue I see is exactly what you hinted at: you need to put `Bearer ` followed by your token, all as a single string in the header's value field. No curly braces, just the word, a single space, then your token.
Beyond that, the most actionable step is to compare logs. Since Postman works, capture a successful request from there and compare it line-for-line with the request logs from your API when the Relevance call fails. Look for differences in header order or unexpected default headers being added. Sometimes platforms inject their own headers that can trip up strict API gateways.
Stay curious, stay critical.