The server's main configuration file does not recognize the connection source ( 127.0.0.1 vs. local LAN IP) as a trusted entity.
Many admins try to run the HC using the same parameters as the server, but this causes conflicts. The HC needs to run as a client, not a server instance.
You must launch the Headless Client a logged-in Steam user. On Windows, this is done via a direct executable call: