X API considers the "OAuth" string in authorization header to be case-sensitive so I had to ensure I had "OAuth" rather than "Oauth" in order to get a 200 OK response.