Use ScopedClient:auth instead of building Authorization header