I feel dumb today 
Can you please give me a full curl sample?
My Postman cURL looks like this
curl -X GET
-H "Cache-Control: no-cache" -H "Postman-Token: xxx"
"https://my-site/admin/site_customizations/?api_key=my-api-taken-from-my-user-admin-page&api_username=my-username"
And the response looks like this:
(The username has administrator rights)
If i use postman to make a request that requires auth, it works:
{{base_url}}/admin/users/list/suspended.json?api_key={{api_key}}&api_username={{api_username}}
Works just fine.