@vieux 

It was not encoded as base64 but sent as a full json object in the body of the request of the "push" part.
There was no authentication during pull.

I understood the question to be regarding sending a full object instead of a basic auth header.