Same site, logged in, and the REST API still treats you as a guest. Without a nonce, cookie authentication acts as if the request is unauthenticated, so you get 401 rest_forbidden.
Three ways to consume your own API: ① fetch: localize resturl() and wpcreatenonce( ‘wprest’ ) from PHP, send X-WP-Nonce. ② apiFetch: createRootURLMiddleware and createNonceMiddleware on your screens; core sets them up in the editor. ③ restdorequest(): PHP to PHP, no HTTP. permission_callback still runs.
Nonces expire. An expired one returns 403 restcookieinvalid_nonce. apiFetch fetches a new nonce and retries; with fetch, handling it is your job.