Best guess I have re why this didn’t work in Postman is something to do with headers. Once I had it working in Python, I moved on to the next pressing matter on my todo list.
click on the “x hidden” headers to reveal hidden headers
find the “cookie” and click on “go to cookies”
Then I deleted all the cookies for the domain I was posting to. Now when I run the query again it no longer returns the HTML authorization in the body! Success!
Note: if anyone else runs into this issue, you can only create one CarrierService per Private App / Custom App. So if you try to create a new CarrierService (with a Custom App that has already created one) you’ll receive an error saying “[name of carrier] is already configured”.