SOLVED - Error Unauthorized on API requests

I just set up cockpit with Apache.
the web interface works as it should, but i cant access the apis. i always get

{
  "error":"Unauthorized"
}

i tried with the master key, with a custom token and with user tokens

does anybody have a clue? i thought that maybe it is apaches fault, but i have the .htaccess file with mod_rewrite. also url navigation in the interface works, so rewrite should be correct

.htaccess:

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^(.*)$ index.php?$1
</IfModule>

apache config:

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerAdmin a@a
        DocumentRoot /var/www/domain.xyz/html
        ServerName domain.xyz

        <Directory /var/www/domain.xyz/html/>
            Options Indexes FollowSymLinks
            AllowOverride All
            Require all granted
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        <IfModule mod_dir.c>
            DirectoryIndex index.php index.pl index.cgi index.html index.xhtml $
        </IfModule>

       SSLCertificateFile /etc/letsencrypt/live/domain.xyz/fullchain.pem
       SSLCertificateKeyFile /etc/letsencrypt/live/domain.xyz/privkey.pem
       Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

any help is much appreciated!

Solved it by replacing my .htaccess with the one from https://github.com/agentejo/cockpit/blob/next/.htaccess