The deployment architecture will definitely affect the results you expect. Since nginx is available, kumo only needs to authorize the ip address of the machine where nginx is located. It has nothing to do with the requester. This is why all configurations need to be provided to evaluate
I’ve updated to the latest version, removed the network mask and also dropped the basic auth from the request — and now everything works.
Strange, but at least it’s working this way.