Here’s my config for Authelia, maybe it helps:

    - domain: music.server.home
      policy: bypass
      resources:
        - '^/rest.*'
        - '^/api.*'
    - domain: music.server.home
      policy: one_factor