JSON JWT Tokens not working

It seems that your api key has a default role attached to it. Remove the default role for the app (api key) and then you will require a session token as well.