Answer
In a confirmed case, this traced to a DNS configuration issue on the server being used to access the API — a misconfigured or stale DNS resolution on that server's side caused requests to be denied with a 403 even though the API itself and its authorization were correctly set up (which is also why Postman, likely resolving the endpoint differently or from a different network path, worked fine). If a 403 shows up from one specific calling environment/server but not from a tool like Postman on a different machine, checking that server's DNS configuration for the API's hostname is worth doing before assuming the problem is in the API's own authorization setup.