Add a second kind of authenticated proxy, that is more appropriate for non-interactive HTTP APIs, where SSO isn't practical. The proxy enforces admin authentication using application-specific passwords.
Enable it for a public_endpoint with the 'enable_api_proxy' option.