I have installed the screepsmod-auth mod and its working correctly (as i can reach the /authmod/password/ endpoint and i was also able to set a password with the cli by using setPassword('username', 'password'))

But when i try to actually use any of the api endpoints, they all return {"error":"unauthorized"}. I have tried using query params in the browser (eg /api/user/code?user=username&pass=password) and i've tried using curl with -u username:password.

I know much of the web api is undocumented, and some of it reads like you need to use an api token and not a username and password, but there doesn't seem to be a way to get an api token when you are logged into a private server?

How are others utilizing the web apis with their private servers? Am i missing a major piece of configuration somewhere?

requests.post(
    "http://{}/api/auth/signin".format(SERVER_URL),
    json={
        "email": USERNAME,
        "password": PASSWORD,
    }
)

Step 2: Put the TOKEN in the API request headers.

requests.post(
    "{}/api/user/code".format(SERVER_URL),
    headers = {
        "X-Token": TOKEN,
        "X-Username": TOKEN,
    },
    json={
        "modules": CODE_TEXT,
        "branch": BRANCH_NAME,
    },
)

Here is a list about all API I could found (written in Python). Most of them are tested. https://github.com/Qionglu735/screeps_tool/blob/master/screeps_api.py#L185