Thats where I am confused it works for me without Authorization header in Postman and I don't know why

So there is no password or secret required to call the api?

How does the authorizion work for SaaS. It seams to work without the Autherization header and only a session cookie is needed?