bearer + basic authentication