API support for header-based authentication