A temporary workaround may be to remove the quotes here which will allow a comma separated list to be used in the EXTERNAL_HTTP_PULL_URL env var, but it doesn't work if you need more than one authorization (and/or mind sending your key to multiple endpoints).
Use case: I want to pull two different types of data from two completely different endpoints with different authorization.