API returns 401 although I generated a key

Exactly. The flow is: 1. Post your email and password to the login endpoint. The response contains a token field. 2. Send that value on every subsequent request as an Authorization header with the Bearer prefix. 3. When you are finished, you can call the logout endpoint, which revokes only the token you used, not your other sessions. A few practical notes for scripting: The auth endpoints are rate limited to 10 requests per minute per IP, and that budget is shared across register, login, password reset and Google sign-in. So authenticate once at the start of your script and reuse the token, rather than logging in per request. A loop that logs in each iteration will hit the limit quickly. Store the token as a secret in your CI system, never in the repository. If it leaks, resetting the account password revokes every token for that account. And since the token is tied to a user, that user's role determines what the script can do. Creating monitors requires organization owner or admin, so a script running as a plain member will get authorization errors rather than 401.