Getting a CAPTCHA on the API authorize URL

I saw on this post that a User-Agent header is also required. That’s not mentioned in the docs, but I tried adding User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0 too, and I still get the same result.