When following a redirect with '-L', curl removes credentials, including a header set with '-H "Authorization: ..."', if the redirect target is on a different host than the original request. The request to the new host therefore arrives unauthenticated and typically returns 401 or an empty result, which looks like the token being wrong.
This is deliberate protection against leaking a credential to whatever host a server chooses to redirect to. It commonly bites with artifact downloads, where an API host redirects to an object storage host that expects a signed URL and no Authorization header at all, and with GitHub release assets.
'--location-trusted' keeps sending the credential across hosts. Use it only when you control both endpoints, because a compromised or misconfigured first host can then harvest the token. The safer pattern for artifact downloads is two steps: request without -L, read the Location header from '-D -' or '-w "%{redirect_url}"', then fetch that URL in a separate curl invocation with no Authorization header.