You need basic authentication. You pass it on the header. (assuming you are using curl or something like Restlet)
I uploaded a gist here so you can see it. It is written in Java.
https://gist.github.com/kgiannis/97b57b956eeeab9af067b2df74900c3d
It is a simple RPC client so you can test your multichain.
As you can see you have to pass a MultichainApiCommand object.