Pass auth config through headers rather than as URL param