As noted in the auth doc here, all REST Admin API queries require a valid Shopify access token. Instead of your api_key and api_password, the header needs to include the access token as a X-Shopify-Access-Token header on all API queries like this:
Hope that helps!