Yes, maybe I got your last question wrong. The API connection does work (I’m using Insomnia to test it). The error occurs for the human user trying to reach the panel.
As a “human” user to access the directory at all, I need to authorize via .htaccess first. Then, when the homepage loads, my “human” .htaccess-credentials are returned by var_dump($_SERVER['HTTP_AUTHORIZATION']) (temporarily added to the home-template).
I just found out that the moment I log into the directory via .htaccess, a file .logins is being created in /site/accounts of the Kirby installation. That is before I even try to log into Kirby.
This does not happen at an API request (Insomia).
The file says:
{"by-ip":{"xxxxxxxxxxxx":{"time":1664122310,"trials":5}},"by-email":[]}
I masked by-ip for this post, but by-email is originally empty.
What’s also Interesting is that trials counts up everytime I reload the page (again without even trying to reach the panel).