I don’t know why on the example post request for the method they only list API Key. I’m just telling you it works in my own portal and a trial portal I have. I have postman setup and I’m not using API Keys and I’m able to create new custom objects just fine. They also list clearly the migration information on that page. It is supposed to work with private apps.
So I’m trying to isolate your issue to code or something else. If it works in Postman, we know it’s code related. If it doesn’t work in Postman, we know is’ account, configuration, token related.