Authenticating REST requests from a headless front end

Solid breakdown. The only thing I would add is to back up before making the change — better safe than sorry.

Adding a small note: the same idea applies on mobile, just with a bit more attention to tap targets.

This deserves more votes. It is a small change with an outsized impact on day-to-day use.

Thanks for writing this up. Bookmarking it — the kind of thing I will want to reference again in a month.

Following this thread closely. We are about to face the exact same decision and the replies here are gold.