What is wrong with my HTTP request to place an order?

Hello,

I’m trying to make my first live order with Alpaca, but I’m getting stopped by HTTP. I can query my account status just fine, but it tells me I’m not authorized (401) to place an order.

Below is what the header looks like. Can you spot what is wrong?

POST /v2/orders HTTP/1.1
Host: api.alpaca.markets
User-Agent: libcurl/7.84.0
Accept: */*
Accept-Encoding: deflate, gzip
APCA-API-KEY-ID: ******
APCA-API-SECRET-KEY: ******
Content-Type: application/json
Content-Length: 119

And here is the JSON payload I am trying to send.

{"symbol":"AAPL","qty":null,"notional":"20","side":"buy","type":"market","time_in_force":"day","extended_hours":"true"}

I am able to see my account status just fine, so my keys appear to be still valid.