@ludsjo-c9 that's because the authentication still redirecting to login page. this is configured on Web.Config
    
<authentication mode="Forms">
      <forms name="NOPCOMMERCE.AUTH" loginUrl="~/login" protection="All" timeout="43200" path="/" requireSSL="false" slidingExpiration="true" />
</authentication>

if you remove this line, it will give you error 401 instead of redirect to login page. if you want both are working, try to add new custom authentication for API with 401 error code response.

ex:

public class MyAPIAuthorizeAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
    {
        actionContext.Response = actionContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized, "Unauthorized");
    }
}