#!/usr/bin/perl

use strict;
use LWP::UserAgent; 

my $token="";

my $uri = 'https://github.com/punesemu/puNES'; 
my $json => '{"username":"user","password":"pwd"}'; 
my $req = HTTP::Request->new('POST', $uri ); 
$req->header( 'Content-Type' => 'application/json'); 
$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $message = $lwp->request( $req ); 

if ( $message->is_success ) {
    my $token= $message->content;
    print "\n Received POST Response:\n$token\n";
} else {
    print "error code:",    $message->code,"\n";
    print "error message:", $message->as_string(), "\n"; 
}

error code:403
error message:HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Connection: close
Date: Sun, 29 Jan 2023 23:51:36 GMT
Server: GitHub.com
Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame
Vary: Accept-Encoding, Accept, X-Requested-With
Content-Type: text/plain; charset=utf-8
Client-Date: Sun, 29 Jan 2023 23:51:40 GMT
Client-Peer: 140.82.121.3:443
Client-Response-Num: 1
Client-SSL-Cert-Issuer: /C=US/O=DigiCert Inc/CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1
Client-SSL-Cert-Subject: /C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=github.com
Client-SSL-Cipher: TLS_AES_128_GCM_SHA256
Client-SSL-Socket-Class: IO::Socket::SSL
Client-SSL-Version: TLSv1_3
Client-Transfer-Encoding: chunked
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Set-Cookie: _gh_sess=E%2FXP3lgu582cURwnByOLH4bQXxdIustR7%2BLLYoM8LvAsVLIZ6J%2FwP2xKdOdXTdOT7bSQvwHRfZDdwgKVWZ83aM5Tw4jD4hgvuWw4FJipikDAIBfx7bIRxDT%2BHu%2B6v3mPD%2BpbnezQkJHXBDFzHCln2cBx%2FfnjdjDu%2Buw7%2Fa1X7%2FIcl%2BIYKDM79mNnYmkL8VZCiJPwJw%3D%3D--ttDckMfA7a%2BcG5o7--ijrpO2QavxKMiStaaoG1Mw%3D%3D; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-GitHub-Request-Id: D87C:9AD5:1EDD5F5:202975C:63D70688
X-XSS-Protection: 0

Cookies must be enabled to use GitHub.