when you create personal access token, can you select api and read_user scopes and try http step again?
api
read_user