Not signed in

No session reached the API. Sign in on the main site first; the cookie is set on the shared parent domain, so this site picks it up with no second login.

Locally that means http://localhost:3000/login — and it has to be localhost, not 127.0.0.1. The two do not share a cookie jar (docs/LOCAL_DEV.md §6.1).

API said: not authenticated