Sorry, this is not working for me. This is what I do:

curl -d "action=login&password=password&code=" "http://192.168.8.1/cgi-bin/login_cgi" -c D:\cookie.txt
{
        "success":      true,
        "token":        "uOlugdLdJyHdSfHS7WFavgOQ2A5WqI6U"
}

Then I get a CGI Session ID in my cookie and with this I can check my login status (no token needed):

curl "http://192.168.8.1/cgi-bin/login_cgi?action=checklogin" -H "Cookie: CGISID=8Bgei9PMtcldnZHSFAGOjDqjd18J7bFeEOlPZ1AqcMvwI"
{
        "logged":       true,
        "code_entered": true,
        "new_password": false,
        "language_set": false,
        "flash_ready":  true,
        "via_wifi":     true
}

But when I try to get the list of ovpn configs for example I get an empty result:

curl -H "Cookie: CGISID=8Bgei9PMtcldnZHSFAGOjDqjd18J7bFeEOlPZ1AqcMvwI" 192.168.8.1/cgi-bin/openvpn_cgi?action=get_client_ovpn

Also the /api/client/list is not working, but probably because I only have the CGISID?