on my local smart home server a simple http basic auth is required. For any reason the nuki callback won’t work if basic auth is enabled on my server. Without basic auth everything is working fine.
That’s what I would assume based on your observations and the lack of any hint to authentication in the API documentation. But to be sure, a NUKI employee will have to answer.