New Device: Use authorization header instead of URL