Any login, password = web/settings password (or master password). 401 carries WWW-Authenticate so browsers/Postman prompt. X-Api-Key still works for existing integrations. Docs warn that over plain HTTP the password travels in every request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>