Forget about API passwords, they are useless in production.
You need the "Application Passwords" instead which can be used for "Basic" authentication when calling the REST API.
This requires HTTPS so this is normally not enabled in local development.