Long-lived token for CI/CD pipeline failing with 401

Trying to set up a long-lived API token for our CI/CD pipeline to pull WFM adherence data. I’ve gone to Admin > Settings > OAuth > Tokens and created a new token with the analytics:read scope.

When I use the token in my script like this:

headers = {
 'Authorization': f'Bearer {LONG_LIVED_TOKEN}',
 'Content-Type': 'application/json'
}
response = requests.get(url, headers=headers)

I keep getting a 401 Unauthorized error. The token isn’t expired and I can see it’s active in the console. Is there a specific scope I’m missing for analytics endpoints? The docs mention admin:read but that seems too broad for a pipeline token.