Looks like the Bearer prefix is required for the simplest case of using heroku auth:token

https://devcenter.heroku.com/articles/platform-api-quickstart