Nick is correct that a token is the best way on this, but you still can use password, oh and I believe in this scenario you need to do a post. The API requires a post or get for interaction.
curl -X post https://yoururl/api/services/automation/trigger?api_password=you_password
-H {“content-type”: “application/json”}
-D {“entity_id”: “automation.your_automation”}