Ok, so after a LOT of digging and debugging, I finally figured out the issue (for me at least). I inspected the request being received by phpList, and the Authorization header was never appearing, everything else was.
Was able to fix this through the .htaccess file by adding the following line: SetEnvIf Authorization “(.*)” HTTP_AUTHORIZATION=$1
I hope this can help someone else avoid this issue!