All write endpoints and the manage routes are gated behind HTTP Basic Auth middleware; credentials are configured via [auth] in config.toml or APP__AUTH__USERNAME / APP__AUTH__PASSWORD environment variables.
Ganonmaster