Published apps send an app identifier header that, after a recent change, could get rejected outright and take down data access for the app.
That header is now treated as a request rather than an authorization: without a matching grant the call falls back to the app's own data, and apps launched from a published link stop sending the header at all.