Operator sign in

One password, from AUTH_PASSWORD. The endpoints panels use — their manifest and /api/report — are deliberately not behind this.