Example:
https://docs.redhat.com/en/documentation/red_hat_quay/3.13/html-single/use_red_hat_quay/index#viewing-and-modifying-tags-api

The use of BROWSER_API_CALLS_XHR_ONLY is to enable access to Quay's API from a browser extension (such as Postman) or a browser interface (such as Swagger). The property has no influence on curl requests coming from the command line. Relevant code:

https://github.com/quay/quay/blob/dc8ad71acdef45e28fe8c6186d1892b91c839f64/config.py#L651-L653

https://github.com/quay/quay/blob/dc8ad71acdef45e28fe8c6186d1892b91c839f64/endpoints/decorators.py#L258-L285

The explanation what this flag does must be explained in more detail and should not be set at all except when API access from browser is required.