Hello Matthew, thank you for your help!
My anonymous access was turned off.
When I turned it on an adjusted rights - I was able to perform the query.
But I don’t need anonymous access to be on, since I am using API token authorization. I realised that the issue was with the header: GraphQL endpoint expects token to be within X-Auth-Token header, not Authorization.