fetch_private(url, token) sending the standard Authorization: Bearer <token> header, returning the parsed body on 200 but the string 'unauthorized' (without raising) when the status is 401 — checking response.status_code explicitly.fetch_private(url, 'expired-token')
'unauthorized' when the API answers 401
The 401 branch is handled, not raised.
headers={'Authorization': f'Bearer {token}'}.
Check status_code before raise_for_status.