Request authentication depends on the configured authentication chain. Default authentication mode for API calls is Basic Authentication.
See Authentication and User Management for a comprehensive view on authentication possibilities with Nuxeo Platform. You should note that by default, the authentication chain used for API calls is contributed via a specific endpoint (and one for command calls specifically).