When a report loads data from a protected JSON endpoint, you can attach authentication headers in the onBeginProcessData event.

Add custom headers before the data request.
var report = new Stimulsoft.Report.StiReport();

report.onBeginProcessData = function (args) {
    if (args.database === "JSON" && args.command === "GetData" &&
        args.pathData && args.pathData.indexOf("/reports/ProtectedDemo.json") >= 0) {
        args.headers.push({ key: "X-Auth-Token", value: "*YOUR TOKEN*" });
    }
};

report.loadFile("../reports/SimpleListWithProtectedJson.mrt");
report.renderAsync();

How it works. The engine applies the headers to its data request, so the report can read endpoints behind token or session protection.
In the screenshot below you can see the result of the sample code:

Supply Custom Headers for Json Database

Hi. Need any help?