Pretty sure the cookie is not enough. Your request needs a X-CSRF-Token as well. Here’s an in-depth explanation; Accessing the Roblox API - the comprehensive tutorial
Also note that the cookie will become invalid at every IP change. So if you use Replit you can’t really authentificate.