First of all, you are using an ancient version of Admin Tools. While there used to be a problem with the .htaccess Maker blocking the Authorization header, this was addressed in Admin Tools 7.3.0. So, one option is to install Admin Tools 7.3.0, go to .htaccess Maker, and click on Save & Create .htaccess to refresh your .htaccess file to the new version.
No version of Admin Tools, however, is blocking the X-Joomla-Token header. This is what we are using ourselves, very extensively. At the most basic level, we're using the Joomla API with the X-Joomla-Token header to publish the new releases to our site. We are of course using Admin Tools and the .htaccess Maker to protect our site as well. If Admin Tools or its .htaccess Maker blocked the X-Joomla-Token header we would have been unable to publish any software the last 15 months this site is on Joomla 4.
Which brings us to your second problem. The order of operations matters for understanding what happened; thank for describing thoroughly what you did, it helped a lot.
The message you get from Admin Tools is because you failed the authentication too many times when trying to use the Authentication header and you've enabled the option in Admin Tools to treat logins as blocked requests. Therefore the multitude of failed logins resulted in your IP address becoming temporarily banned by Admin Tools, hence the message about your IP being blocked. You need to unblock your IP to stop that message from appearing.
TL;DR: Install the latest version of Admin Tools. Regenerate your .htaccess Maker. Unblock your IP address. You're good to go!
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
