This seems like a lot of work, why can't we just use basic auth or a bearer token?