I’m guessing there’s something going awry with your JWT token generation as you suspect.
To eliminate as many variables as possible, are you able to try making an API call with Node using our SDK? If that works, then you can know that the environment is the issue here (Xano) — I’ve seen instances where some environments generate JWTs differently, which causes this error (e.g., in Google Scripts).