Non-sensitive summary of the credentials a request carried.
What the `Authorization` header carried. - `'bearer'` — a bearer token that looks like a JWT - `'api-key'` — an `sb_*` API key, which the Supabase SDK forwards here alongside the `apikey` header; not a user token - `'non-bearer-scheme'` — present but unusable (wrong scheme, wrong casing, bare value, empty token) - `'absent'` — no header
The `apikey` header classified by prefix. Never the value itself.