see RESTful Command - Home Assistant
The documentation states:
username string (Optional)
The username for basic HTTP authentication (digest is not supported).password string (Optional)
The password for basic HTTP authentication (digest is not supported).
For Shelly devices (RPC/http calls) this authentication is mandatory, see Authentication | Shelly Technical Documentation
Current workaround is to use Shell Command instead of RESTful Command integration and do something like
shell_command:
shelly_display_tap_command: 'curl --anyauth -u admin:MySecretPassword http://192.168.200.34/rpc/Ui.Tap?x={{x}}&y={{y}}'
one drawback doing it this way is, for example, that you cannot use secrets.yaml