Guest API message send returns 401 despite valid auth token

Trying to implement raw Guest API calls to bypass the Messenger widget. Getting a 401 Unauthorized on POST /api/v2/conversations/messaging/messages even though the Bearer token is fresh. Here’s the fetch call:

const res = await fetch(url, {
 method: 'POST',
 headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
 body: JSON.stringify({ to: { id: 'external' }, text: { content: 'test' } })
});

Token works for GET /api/v2/messaging/contacts/me. What am I missing?