Nvm... there were cookies set for API.xxxxx.com, so when I made a request from xxxxx.com, it was using the wrong cookies