julienmonnerie/kirby/config/api/authentication.php

<?php

use Kirby\Exception\PermissionException;

return function () {
	$auth               = $this->kirby()->auth();
	$allowImpersonation = $this->kirby()->option('api.allowImpersonation') ?? false;

	// csrf token check
	if (
		$auth->type($allowImpersonation) === 'session' &&
		$auth->csrf() === false
	) {
		throw new PermissionException('Unauthenticated');
	}

	// get user from session or basic auth
	if ($user = $auth->user(null, $allowImpersonation)) {
		if ($user->role()->permissions()->for('access', 'panel') === false) {
			throw new PermissionException(['key' => 'access.panel']);
		}

		return $user;
	}

	throw new PermissionException('Unauthenticated');
};