When sending a request with an Authorization header (e.g. making a request with an OAuth bearer token), the header gets stripped by apache and does not reach the PHP process. This can be checked by inspecting the $_SERVER, which does not contain said header.

I verified that adding the the following two lines to the existing apache site conf solves the problem (related stackoverflow answer):

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

I tried this in both mwcli (dev/stretch-apache2:2.0.0) and MediaWiki-Docker (dev/buster-apache2:1.0.0-s1).