Lumen and JWT - token_not_provided

Hey!

Nice to see this package has now made it into 5.3 - currently working with JWT and am having a issue I thought I'd ask.
I'll quickly explain as far as I've managed to get.

Currently, I have all - barring one - of my API routes protected. The only route that isn't protected is my /login route that allows for authentication (my API will be used to authenticate from a mobile application).

When the user makes a POST request to the above route with valid credentials, it returns the token. So I believe I've got everything right up to that point?

I have a few of other routes in my API which are /orders, /entries and /users

When attempting to make a GET request to any of the above - after successfully logged in - it gives me the following;

{
"message": "Failed to authenticate because of bad credentials or an invalid authorization header.",
"status_code": 401
}
Looking at the headers, I can see that there is no authorization header - is there a reason why this is not set? After a bit of reading, I was made aware that sometimes Apache have a similar issue and have to add the following to their .htaccess

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
Which I have done but still have no luck.

The only way I can make the request, is if token is passed as a URL param - is this how I'm supposed to make future requests?