Sometimes it is also due to authorization via HTTP, especially with regard to the REST API of WordPress. In this case the following snippet in the .htaccess helps:
<IfModule mod_rewrite.c>
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</IfModule>