The HTTP API uses a JWT-based scheme, not an "ApiKey <key>" scheme.
`auth/login.go` accepts `Authorization: Bearer <api-key>` on
`/auth/login`, returns a JWT, and the JwtAuthMiddleware then expects
`Authorization: Bearer <jwt>` on every `/api/*` request. The previous
example would 401.
Replace the section with the actual two-step flow plus a working
`curl` invocation for each step. Also fix the endpoint path
(`/api/messages`, not `/messages`).
M. L. Giannotta