Here are the REST API docs for _changes.
But if you want to authenticate, use HTTP Basic auth — i.e. add a standard WWW-Authenticate header with the username/password encoded in it.
Also, it’s kind of unusual for an app to access a server/peer’s _changes API directly; usually it would let the replicator talk to the peer.