OAuth App-Only, 403 client forbidden only on second API call. Unable to fix after studying the lib/X docs.

[mbonete]

I am trying to create a bot authenticated as OAuth App-only. I am using the following code as proof of concept:

const { TwitterApi } = require("twitter-api-v2");

const API_TOKEN =  "AAAAAAAAAA...redacted...Jz";

const appClient = new TwitterApi(API_TOKEN);

const wait = (sec = 1) => new Promise((resolve) => setTimeout(resolve, sec * 1000));

async function main() {
  const { data: botUser } = await appClient.v2.userByUsername("redacted_bot_handle");
  console.log("ID", botUser.id);
  await wait(3);
  const mentions = await appClient.v2.userMentionTimeline(botUser.id);
}

main();

The first call works well and returns the user. Unfortunately the second API call fails:

  data: {
    client_id: 'redacted',
    detail: 'When authenticating requests to the Twitter API v2 endpoints, you must use keys and tokens from a Twitter developer App that is attached to a Project. You can create a project via the developer portal.',
    registration_url: 'https://developer.twitter.com/en/docs/projects/overview',
    title: 'Client Forbidden',
    required_enrollment: 'Appropriate Level of API Access',
    reason: 'client-not-enrolled',
    type: 'https://api.twitter.com/2/problems/client-forbidden'
  }

On Twitter side, I am using the credentials generated by the platform. The application is attachedd to a project (called Project name), as it can be seen in the screenshot:

I think the permissions are set correctly in the platform. I requested access to everything (read/write/dm) and set the app type as bot:

According with mention docs it should work with OAuth 2.0 App-only. If something was wrongly configured at credential level, I assume the lookup by username (which also works with App-only according to the docs would fail too). Checking the basic and auth sections of the library docs seems to refer to the way I'm doing it. Only difference being filtering the methods by prefixing a .read before (which as far as I know, shouldn't be required).

Changing the first line for other App-only accesible method seems to fail likewise. So far, that is the only method that worked.

Any suggestion on what can I be doing wrong? Is there anything I may be missing?