Forget about API passwords, they are useless in production.
You need the "Application Passwords" instead which can be used for "Basic" authentication when calling the REST API.
This requires HTTPS so this is normally not enabled in local development.
If you are using environment variables, you can simply set:
WP_ENVIRONMENT_TYPE=local
I used this when using the official Docker image of WordPress.
Restart the application and application passwords should now be enabled.
I assume that
WP_ENVIRONMENT_TYPE
would be onwp-config.php
is that correct?