I'm not sure what the difference is between the Invoke-RestMethod function in Powershell 5.1 vs 6.0 is, but my guess is that since you can specify the authentication method in 6.1, it creates and sends the authentication header for you instead of you having to create it yourself. Neither method is all that secure since base64 is not encryption (it probably looks exactly the same in a packet capture between 5.1 and 6.0). I really wish the iX folks would support API Keys for this, but from my digging into the files in /usr/local/www there's still a LOT of Django cruft in there that probably prevents much modernization of the GUI beyond skins (the shiny new angular GUI still talks to a very old Django middleware).
As far as the config file for the v2.0 API goes, I don't think there is one. At least I haven't been able to find it in all my digging. I'm not very familiar with how it all works (and I'm not really a web developer), but it looks like that config may be generated on the fly by the Django middleware. An iX developer might be able to tell us for sure though if there are any lurking on the forum...