Found it! I need to set NETRC=/dev/null. It appears the request library is trying to grab auth info from .netrc, and in my case, picks the default entry. Why it is doing that despite an api key being provided is unclear.
The openapi library seems to use requests incorrectly.
> If no authentication method is given with the auth argument, Requests will attempt to get the authentication credentials for the URL’s hostname from the user’s netrc file. The netrc file overrides raw HTTP authentication headers set with headers.
