Todo API with the authorization header