[API] Allow authentication with header