All the flashy curl boxes misdirect the consumer:   *** Would you think to use X-API-Key instead? `curl --header 'X-API-Key: RhxUmsGG.7HYGRRnDTkJ7rPcQVbNHj8ls9Ysdt2tP' 'http://localhost/api/customers/'` It is documented when you scroll down on the first page. I had to try various variants, and at some point figured the application was broken.