Anyone working on a way to bring back api_password?

Initial testing tells me this is going to work. You can secure it more by adding localhost etc.

server {
    listen 8124;
    location / {
        proxy_pass http://localhost:8123;
        proxy_set_header Authorization "Bearer Th34J2XQxyzHPHtmHdcF1h4";

    }
}