Have you set up the Security Provider in the Globals section of the API (Server Connect)?
This should be a good reference, too: