All API endpoints (except health check and installation endpoints) require authentication via Bearer token. The token is the password configured in the server's [auth] section.
[auth]