Without seeing the request code I initially assumed it would be `Authorization: Bearer logo` that did the trick.