All requests (other than /login) require an HTTP header set with your token.
The key for the header is “Authorization”.
The value is “Bearer your_token_here”.