For each call to the Boxcab API, you'll have to pass the handle of your site and its related API key. Those 2 properties can be found the Config variables section in the settings page of your Heroku application.
Another way to get them is to run
heroku config at the root of your local Rails application.
The names of the config variables are BOXCAB_SITE_HANDLE and BOXCAB_API_KEY.
Each API endpoint returns a JSON response.
If you're not authenticated, you get a 401 error status and the following JSON message