Paste the ADMIN_TOKEN, or an account-service access token for a user with role=admin. Local dev only: set ADMIN_AUTH_DISABLED=1 to bypass (never in production).