Why I need add the `Authorization` in the request header when access the APIs?

You add 'rest_framework.authtoken' to INSTALLED_APPS and set

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticatedOrReadOnly',
    ),
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
    )
}

in settings.py. Then DjangoRestFramework will check you identity when you ask server with unsafe method like post\patch\delete.You login method is handle by post method which will ask identity.But you get your token after login.

Two way to handle you problem, one is set:

'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.permissions.AllowAny',
),

which is not recommend.second way is set permissions for your login method like:

from rest_framework.permissions import AllowAny
@list_route(methods=['POST'], permission_classes=[AllowAny])
def login(self, request):
    pass