I haven’t tested this setup, but it seems like you need to enable auth for your custom controller endpoint from settings.