Auth for API always always says not allowed

I'm trying to use the API to automate adding email domains to the blacklist (https://api.mailbox.org/v1/doc/methods/index.html#mail-blacklist-add) but I can't get past the first step for getting auth-id (https://api.mailbox.org/v1/doc/welcome/Grundlegende-Informationen.html). The result of sending a POST request to https://api.mailbox.org/v1 with JSON body such as

{

"jsonrpc": "2.0",

"method": "auth",

"params": {

"user": "THE EMAIL I USE TO LOGIN AT MAILBOX.ORG",

"pass": "THE PASSWORD I USE TO LOGIN AT MAILBOX.ORG"

},

"id": "1"

}

doesn't work. The response is
{

"jsonrpc": "2.0",

"error": {

"code": 2,

"message": "Zugriff verweigert"

},

"id": "1"

}

Do I have to use a different password? I can't find a way to generate a new key or account.