Just a point - you need to include the API KEY & Password as a part of URL & need not to send as headers.