Turns out that some headers are sent in lowercase format on Android, whereas the backend, which is built on PHP, is case sensitive when dealing with headers. Thus, the Axios request sent the 'authorization' header but the server expected an 'Authorization' header (notice the difference in case.) I adjusted the server to convert the headers into lowercase before doing the authentication process using JWT.