Explitly set JSON spaces to ensure regex matches with different ENV
Change invalid_token to 401