Also, got a reply from the devs saying: I think your issue may be that you need to include all the -F parameters in the header. Here is a thunkable post that explains a bit:
This seems to suggest they’re using curl to do the API request, which I’m not. I tried adding all the parameters to the header instead and then it doesn’t have authorisation. I then tried adding the API key into the API POST call JSON as a separate JSON parameter but that didn’t work either {sigh}