diff --git a/web-tester/src/main/java/com/axonivy/ivy/webtest/engine/WebAppFixture.java b/web-tester/src/main/java/com/axonivy/ivy/webtest/engine/WebAppFixture.java
index c3f6484..c4871b9 100644
--- a/web-tester/src/main/java/com/axonivy/ivy/webtest/engine/WebAppFixture.java
+++ b/web-tester/src/main/java/com/axonivy/ivy/webtest/engine/WebAppFixture.java
@@ -19,6 +19,8 @@
 import static com.codeborne.selenide.Selenide.$;
 import static com.codeborne.selenide.Selenide.open;
 
+import java.net.Authenticator;
+import java.net.PasswordAuthentication;
 import java.net.URI;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
@@ -57,6 +59,9 @@
  */
 public class WebAppFixture {
 
+  private static final String VAR_PATH = "variables";
+  private static final String CONFIG_PATH = "configs";
+
   /**
    * <p>Login to a user.
    * This user will be used as long as the browser context isn't closed or the {@link #logout()} method is called.
@@ -121,7 +126,7 @@ public void logout() {
    */
   public void var(String name, String value) {
     try {
-      var url = EngineUrl.create().rest("webtest/var").toUrl() + "?name=" + name + "&value=" + value;
+      var url = configRestUrl(VAR_PATH) + "?name=" + name + "&value=" + value;
       sendRequest(HttpRequest.newBuilder(new URI(url)).POST(BodyPublishers.noBody()));
     } catch (Exception ex) {
       throw new RuntimeException("Couldn't set variable", ex);
@@ -142,7 +147,7 @@ public void var(String name, String value) {
    */
   public void resetVar(String name) {
     try {
-      var url = EngineUrl.create().rest("webtest/var").toUrl() + "?name=" + name;
+      var url = configRestUrl(VAR_PATH) + "?name=" + name;
       sendRequest(HttpRequest.newBuilder(new URI(url)).DELETE());
     } catch (Exception ex) {
       throw new RuntimeException("Couldn't remove variable", ex);
@@ -162,7 +167,7 @@ public void resetVar(String name) {
    */
   public void config(String name, String value) {
     try {
-      var url = EngineUrl.create().rest("webtest/config").toUrl() + "?key=" + name + "&value=" + value;
+      var url = configRestUrl(CONFIG_PATH) + "?key=" + name + "&value=" + value;
       sendRequest(HttpRequest.newBuilder(new URI(url)).POST(BodyPublishers.noBody()));
     } catch (Exception ex) {
       throw new RuntimeException("Couldn't set config", ex);
@@ -183,19 +188,32 @@ public void config(String name, String value) {
    */
   public void resetConfig(String name) {
     try {
-      var url = EngineUrl.create().rest("webtest/config").toUrl() + "?key=" + name;
+      var url = configRestUrl(CONFIG_PATH) + "?key=" + name;
       sendRequest(HttpRequest.newBuilder(new URI(url)).DELETE());
     } catch (Exception ex) {
       throw new RuntimeException("Couldn't remove config", ex);
     }
   }
 
+  private static String configRestUrl(String path) {
+    return EngineUrl.create().app("system").rest("apps/" + EngineUrl.applicationName() + "/" + path).toUrl();
+  }
+
   private void sendRequest(HttpRequest.Builder requestBuilder) throws Exception {
-    var client = HttpClient.newHttpClient();
+    var client = HttpClient.newBuilder()
+            .authenticator(new RestConfigAuthentication())
+            .build();
     var request = requestBuilder.header("X-Requested-By", "webtest").build();
     var response = client.send(request, BodyHandlers.ofString());
     if (response.statusCode() > 399) {
       throw new RuntimeException("Couldn't send web app fixture request (status code: " + response.statusCode() + "): " + response.body());
     }
   }
+
+  private static class RestConfigAuthentication extends Authenticator {
+    @Override
+    protected PasswordAuthentication getPasswordAuthentication() {
+      return new PasswordAuthentication("admin", "admin".toCharArray());
+    }
+  }
 }