Does this work? I think the key is just 'Authorization' and the value is 'Bearer <token>'. At least that's how I'm making all of my requests.