My working solution is only basic-auth on login API.
deploy stack on docker swarm with labels.
...
traefik.http.middlewares.auth.basicauth.users: ${BASIC_AUTH}
traefik.http.middlewares.auth.basicauth.headerField: X-WebAuth-User
traefik.http.middlewares.auth.basicauth.removeheader: "true"
traefik.http.routers.portainer-auth-login.rule: Host(`${DOMAIN}`) && Path(`/api/auth`)
traefik.http.routers.portainer-auth-login.priority: 25
traefik.http.routers.portainer-auth-login.middlewares: auth
traefik.http.routers.portainer-auth.rule: Host(`${DOMAIN}`)
traefik.http.routers.portainer-auth.priority: 10
...