Depends on the web server end. If you don't have fast cgi installed then you may need to add at the end of the Endpoint with '?Key='. If you do and your web server doesn't complain about it then put it in the password field in the curl.
Please take a look here in their documentation to see what they do with the api key
https://invisioncommunity.com/developers/rest-api