I checked network tab, and found out 2 requests spawned. First one to https://<repo>.prismic.io/api/v2 is OK.
But latter is a bit weird: https://<repo>.cdn.prismic.io/api/v2/documents/search?page=1&pageSize=1&ref=<ref>&q=%5B%5Bat(my.foo-type.uid%2C%20%22abcdef%22)%5D%5D
Sent my repo name to DM. In theory, I could even generate you some temporary access token if it helps, cause my account doesn't contain any sensitive data (yet). And I can always revoke it after the experimentation.