I've installed WP-API along with Basic Auth. I'm able to fetch cpt posts using

curl ={post-type}

However, if I change a post to private, it is no longer returned. This is true even when sending the author's user credentials with either an auth header or simply using

curl http://username:[email protected]/posts?type={post-type}

Is this by design? Am I missing something obvious?

EDIT: Just want to specify, I'm looking for a way to get an author's private posts returned in the JSON feed while providing their credentials using Basic Auth.