Invalid Access using Global Key on All users

This should be Api-Username, not Api-User

This header is only used for “all user” api keys, so that’s why it worked when you scoped the key to a specific user.