This what helped me after all those advices up was to set in simple JWT module

Protect endpoints enabled No Yes* - SET FOR YES!!!!!!!!!

The endpoints will require a JWT in order to be accessed. If no JWT is provided, rest endpoints will provide an error instead of the actual content.