Found the issue. I was loading an image from retool storage for the company logo - for some reason this was throwing a 401. Removed the logo and it's working now. (This is an embedded private app not a public app, not sure if that makes a difference)