There’s more information about the authorisation token flow and the sequence:
As for the Headers, I suspect those were the auto generated headers that are needed for the requests, in the older versions these were being sent in the background and you were not made aware - now these have been made visible to the users. There’s an option to hide these or they can be disabled/overwritten.
The Lightweight API Client would be a great fit for you if all you need is something to build requests with and test your endpoints.