The derived signal must be in a folder the caller can read. With an API key that is the customer's service account, which is always in your main customer user group, so the folder must be shared with that group; with a personal access token your own private folders count too.