Looks like the Bearer prefix is required for the simplest case of using heroku auth:token



https://devcenter.heroku.com/articles/platform-api-quickstart