That was two bugs, the token and the missing /tenant/<tenantId> bit (got a 404 once I had the key, then saw it). Running at 30 s now with a read-only key locked to our IP. Buzzer went off this morning when they filled it, so it works.
Measure twice, poll once.