Answer
Two separate conditions commonly need to both be true: the user's directory ID may need any domain suffix (like an email-style @company... portion) stripped for Basic authentication to work correctly, and the specific projection behind that API endpoint needs to be explicitly marked as included for the relevant external/compatibility application type in API Explorer — a working browser login doesn't guarantee either of these is already satisfied for external-tool access.