Hi, I am the main FBBE developer

I can confirm FBBE works without RPC authentication, only via unauthenticated REST as a design choice.

I am not sure why you were seeing those log messages about authentication attempts but they should not be related to FBBE (or there is a bug I am not yet aware)

> though I suspect it also applies to the REST API as well as I have not seen a different set of credentials for it.

The point of the REST interface is exactly that you don't need authentication, as clearly stated in the title of [the official doc](https://github.com/bitcoin/bitcoin/blob/e253568da8dc3693ad99aee260276233245e3d77/doc/REST-interface.md)
The REST interface provides only data about the blockchain and the mempool, it cannot interact with the wallet, this is why could be used without authentication