Hello giuseppebag, You are right, the issue was that the Authorization Header was getting dropped for the subrequests. I looked closer through our vhost files and found that for our internal instances, we remove the Authorization header via:RequestHeader unset AuthorizationRemoving this part made th...