Full spec from https://api.yt2mp3.cloud/docs/ — password is checked on the API server (HttpOnly cookie); removing the login UI in DevTools does not unlock Swagger. Service-only UI: /docs/service/ (no gate).