You and your agent need a way to send a request without a browser in the way.
curl
A command that sends one HTTP request from the terminal and prints what comes back. It takes the browser out of the question, so it tells you whether the server itself works.
It gives an agent a cheap way to prove a claim, and it gives you output you can read. One trap: curl exits 0 even when the server answers with an error, because the transfer itself worked. Use it in a script without --fail and your check can never fail.
Say it to your agent
“Prove it with curl. Run curl -i -X POST localhost:3000/api/notes -H 'Content-Type: application/json' -d '{"text":"hi"}' and paste all of it. Then run it again without the cookie and show me the 401.”