How to complete the challenge POST /secret/note (401)
Use POST /secret/note with a valid JSON note payload, but do not include the X-AUTH-TOKEN header.
The challenger header still identifies your session, but the missing auth token means the API should return 401.