See the Sneak peak: global lock service post for details on this service and the structure of the FLY_CONSUL_URL variable.
Specifically, I think you’re missing this part:
the path section (
/app-name-23sxdf) is the prefix that token has write access to.
If I understand this correctly you need to make sure the Name field in any queries you send to the Consul service start with the provided path prefix, e.g., evcc-consul-4nml16r0rp51vp2y/. Hope this helps!