diff --git a/README.md b/README.md
index 32e0edc..04de762 100644
--- a/README.md
+++ b/README.md
@@ -129,6 +129,17 @@ that call only:
 client.search_slots(state="MA", timeout=10, max_retries=0)
 ```
 
+An operation that declares a header of its own takes it as one more keyword, named from the header
+and typed from the spec. `process_message` takes `payer_authorization`, sent as
+`Payer-Authorization`: a member's own authorization at their insurer, `Bearer` and the access token
+your app got from the member's login there. The SDK checks it against the form the API takes before
+sending, refuses one the API would not take without repeating it, and holds it where nothing prints
+it, a traceback's local variables included.
+
+```python
+checked = client.process_message(message, payer_authorization=f"Bearer {access_token}")
+```
+
 `http_client` passes anything [httpx2](https://github.com/pydantic/httpx2) takes: a proxy,
 certificates, limits, event hooks, a transport. The SDK's own method, URL, headers, body and
 timeout always win, it never follows a redirect, and it never closes a client you pass.
diff --git a/api.md b/api.md
index 6c9d69b..db102d2 100644
--- a/api.md
+++ b/api.md
@@ -10,6 +10,9 @@ snake_case (`name:contains` is `name_contains`, `_count` is `count`); each metho
 both. Every method also takes the per-call options `timeout`, `max_retries`, `correlation_id` and
 `extra_headers`, and `client.with_response.<method>(...)` gives the request id and timing too.
 
+An operation that declares a header takes it as one more keyword, named from the header in snake_case and
+checked before sending: `process_message` takes `payer_authorization`, sent as `Payer-Authorization`.
+
 `batch()` sends several of these as one request, each with its own answer or error, from the entries
 `haau3.calls` makes. It takes every operation on the FHIR base except `fhir_batch`, `process_message` and `reconcile_medications`: 29 of the
 37. See the README's "Several requests in one".
diff --git a/scripts/generate.py b/scripts/generate.py
index 32245ed..cce01d5 100644
--- a/scripts/generate.py
+++ b/scripts/generate.py
@@ -32,6 +32,7 @@
 import hashlib
 import json
 import os
+import re
 import subprocess
 import sys
 import tempfile
@@ -89,6 +90,17 @@ class Param:
     description: str
 
 
+@dataclass
+class Header:
+    """An optional header parameter, sent from a keyword of the call's own named from it."""
+
+    wire: str
+    python: str
+    description: str
+    max_length: int | None
+    pattern: str | None
+
+
 @dataclass
 class Op:
     id: str
@@ -103,6 +115,7 @@ class Op:
     body: str | None
     response: str
     expects: list[str]
+    headers: list[Header] = field(default_factory=list)
     batchable: bool = False
     name: str = field(init=False)
     const: str = field(init=False)
@@ -202,6 +215,36 @@ def _query_type(self, op_id: str, param: Json) -> str:
             f"{op_id}: the query parameter {param.get('name')} has a schema the generator does not read: {schema}"
         )
 
+    @staticmethod
+    def _headers(op_id: str, params: list[Json]) -> list[Header]:
+        """The optional header parameters. A required one, or a parameter in a cookie, stops the generator."""
+        headers: list[Header] = []
+        for p in params:
+            if p["in"] not in ("path", "query", "header"):
+                raise ValueError(f"{op_id}: a parameter in {p['in']}, which the generator does not send")
+            if p["in"] != "header":
+                continue
+            if p.get("required"):
+                raise ValueError(
+                    f"{op_id}: the required header {p['name']}, which a generated method cannot complete without"
+                )
+            schema = p.get("schema") or {}
+            if schema.get("type") != "string":
+                raise ValueError(f"{op_id}: the header {p['name']} is not a string, the only kind the generator sends")
+            pattern = schema.get("pattern")
+            if pattern is not None:
+                re.compile(pattern)  # The spec's ECMAScript pattern, which this one must read as Python does.
+            headers.append(
+                Header(
+                    wire=p["name"],
+                    python=naming.python_name(p["name"]),
+                    description=" ".join((p.get("description") or "").split()),
+                    max_length=schema.get("maxLength"),
+                    pattern=pattern,
+                )
+            )
+        return headers
+
     def _operations(self) -> list[Op]:
         docs = naming.DocsUrls()
         ops: list[Op] = []
@@ -222,10 +265,11 @@ def _operations(self) -> list[Op]:
                     for p in params
                     if p["in"] == "query"
                 ]
-                names = [p.python for p in query]
+                headers = self._headers(op["operationId"], params)
+                names = [p.python for p in query] + [h.python for h in headers]
                 clashes = {n for n in names if names.count(n) > 1} | (set(names) & {*OPTION_NAMES, "self", "body"})
                 if clashes:
-                    raise ValueError(f"{op['operationId']}: query parameters clash as {sorted(clashes)}")
+                    raise ValueError(f"{op['operationId']}: parameters clash as {sorted(clashes)}")
                 tag = (op.get("tags") or ["Other"])[0]
                 ops.append(
                     Op(
@@ -241,6 +285,7 @@ def _operations(self) -> list[Op]:
                         body=self._body(op),
                         response=self._response(op),
                         expects=self._expects(op),
+                        headers=headers,
                     )
                 )
         for op in ops:
@@ -248,6 +293,11 @@ def _operations(self) -> list[Op]:
                 raise ValueError(f"{op.id} is {op.method}; the SDK sends GET and POST only")
         for op in ops:
             mark = self.spec["paths"][op.path][op.method.lower()].get(BATCHABLE)
+            if op.headers and op.path.startswith("/v1/fhir/r4/") and mark is not False:
+                # A batch entry is one request inside the batch's body, which carries no headers of its own.
+                raise ValueError(
+                    f"{op.id} declares the header {op.headers[0].wire} and can go in a batch, whose entries carry no headers"
+                )
             if mark is not None and mark is not False:
                 raise ValueError(f"{op.id} carries {BATCHABLE}: {mark!r}, where the spec defines only false")
             if mark is False and not op.path.startswith("/v1/fhir/r4/"):
@@ -275,6 +325,7 @@ def _signature(op: Op, *, for_call: bool = False) -> str:
     if positional:
         parts.append("/")
     keywords = [f"{p.python}: {p.type}" if p.required else f"{p.python}: {p.type} | None = None" for p in op.query]
+    keywords += [f"{h.python}: str | None = None" for h in op.headers]
     if not for_call:
         keywords += [
             "timeout: float | None = None",
@@ -305,6 +356,16 @@ def _method_doc(op: Op) -> str:
             required = " Required." if p.required else ""
             lines.append(f"- `{p.python}`{wire}:{required} {p.description}".rstrip())
         parts.append("\n".join(lines))
+    if op.headers:
+        lines = ["Headers it declares, each a keyword of its own:", ""]
+        for h in op.headers:
+            limit = f", at most {h.max_length} characters" if h.max_length is not None else ""
+            lines.append(
+                f"- `{h.python}` (`{h.wire}`): {h.description} Checked against the form the API takes for it{limit},"
+                f" before sending; a value it does not take is refused without being repeated, and the keyword wins over"
+                f" a `{h.wire}` in `extra_headers`. Held from the moment the call takes it where nothing prints it.".strip()
+            )
+        parts.append("\n".join(lines))
     return "\n\n".join(parts)
 
 
@@ -313,6 +374,19 @@ def _hide_body(op: Op, indent: str) -> list[str]:
     return [f"{indent}hidden: Hidden[object] = Hidden(body)", f"{indent}del body"] if op.body else []
 
 
+def _hide_headers(op: Op, indent: str) -> list[str]:
+    # A declared header can carry a credential, such as a member's authorization: held at once, the same way.
+    if not op.headers:
+        return []
+    values = ", ".join(f"{h.python!r}: {h.python}" for h in op.headers)
+    return [f"{indent}declared = HeldHeaders({{{values}}})", f"{indent}del {', '.join(h.python for h in op.headers)}"]
+
+
+def _options(op: Op) -> str:
+    held = ", declared" if op.headers else ""
+    return f"Options(timeout, max_retries, correlation_id, extra_headers{held})"
+
+
 def _methods_class(ops: list[Op], *, name: str, asynchronous: bool, with_response: bool) -> str:
     client = "AsyncHaau3" if asynchronous else "Haau3"
     engine = "AsyncEngine" if asynchronous else "SyncEngine"
@@ -352,7 +426,8 @@ def _methods_class(ops: list[Op], *, name: str, asynchronous: bool, with_respons
         else:
             lines.append(docstring(_method_doc(op), "        "))
         lines += _hide_body(op, "        ")
-        call = f"self._engine.call({_call_arguments(op, 'hidden')}, Options(timeout, max_retries, correlation_id, extra_headers))"
+        lines += _hide_headers(op, "        ")
+        call = f"self._engine.call({_call_arguments(op, 'hidden')}, {_options(op)})"
         if asynchronous:
             call = f"(await {call})"
         lines.append(f"        return {call}{'' if with_response else '.data'}")
@@ -430,7 +505,7 @@ def methods_module(spec: Spec) -> str:
         "from typing import TYPE_CHECKING, Any, Literal, TypeVar, Union, overload\n",
         "from . import fhir",
         "from ._batch import BatchResult, Call",
-        "from ._body import Hidden",
+        "from ._body import HeldHeaders, Hidden",
         f"from ._components import {', '.join(own)}",
         f"from ._operations import {', '.join(o.const for o in ops)}",
         "from ._response import Options, Response\n",
@@ -461,13 +536,21 @@ def operations_module(spec: Spec) -> str:
         "from typing import Final, Union\n",
         "from . import fhir",
         f"from ._components import {', '.join(own)}",
-        "from ._operation import Operation\n",
+        "from ._operation import DeclaredHeader, Operation\n",
         f"SPEC_VERSION: Final[str] = {spec.spec['info']['version']!r}",
         '"""The version of the API\'s spec this SDK was generated from."""\n',
     ]
     for op in spec.ops:
         expects = "(" + "".join(f"{t!r}, " for t in op.expects) + ")"
-        lines.append(f'{op.const}: Final[Operation[{op.response}]] = Operation("{op.method}", {op.path!r}, {expects})')
+        headers = ""
+        if op.headers:
+            declared = "".join(
+                f"DeclaredHeader({h.wire!r}, {h.python!r}, {h.max_length!r}, {h.pattern!r}), " for h in op.headers
+            )
+            headers = f", headers=({declared})"
+        lines.append(
+            f'{op.const}: Final[Operation[{op.response}]] = Operation("{op.method}", {op.path!r}, {expects}{headers})'
+        )
     return "\n".join(lines) + "\n"
 
 
@@ -554,6 +637,17 @@ def _readable_signature(op: Op) -> str:
     return f"{op.name}({', '.join(args)})"
 
 
+def _header_keywords(spec: Spec) -> str:
+    """What api.md says of the keywords an operation's declared headers add."""
+    each = [f"`{op.name}` takes `{h.python}`, sent as `{h.wire}`" for op in spec.ops for h in op.headers]
+    if not each:
+        return ""
+    return (
+        "\nAn operation that declares a header takes it as one more keyword, named from the header in snake_case and\n"
+        f"checked before sending: {'; '.join(each)}.\n"
+    )
+
+
 def api_md(spec: Spec) -> str:
     tags = [t["name"] for t in spec.spec.get("tags", [])]
     text = {t["name"]: t.get("description", "") for t in spec.spec.get("tags", [])}
@@ -583,7 +677,7 @@ def api_md(spec: Spec) -> str:
 snake_case (`name:contains` is `name_contains`, `_count` is `count`); each method's docstring gives
 both. Every method also takes the per-call options `timeout`, `max_retries`, `correlation_id` and
 `extra_headers`, and `client.with_response.<method>(...)` gives the request id and timing too.
-
+{_header_keywords(spec)}
 `batch()` sends several of these as one request, each with its own answer or error, from the entries
 `haau3.calls` makes. It takes every operation on the FHIR base except {excluded}: {len(batchable)} of the
 {len(spec.ops)}. See the README's "Several requests in one".
diff --git a/scripts/readme_blocks.py b/scripts/readme_blocks.py
index bff217b..b335e2a 100644
--- a/scripts/readme_blocks.py
+++ b/scripts/readme_blocks.py
@@ -7,7 +7,8 @@
 Blocks are kept in order, so a later one uses what an earlier one made (`client`). A block that
 awaits goes into `readme_async`, the others into `readme_sync`. A block after the line
 `<!-- not run: <why> -->` is type-checked only, in `readme_not_run`. The names the README leaves to
-the reader (`plan_id`, `records`, `message`, `codes`, `job_id`) are the functions' parameters.
+the reader (`plan_id`, `records`, `message`, `codes`, `job_id`, `access_token`) are the functions'
+parameters.
 """
 
 from __future__ import annotations
@@ -25,7 +26,8 @@
 _AWAITS = re.compile(r"\bawait\b|\basync (for|with)\b")
 
 PARAMETERS = (
-    "plan_id: str, records: ReconcileMedicationsBody, message: ProcessMessageBody, codes: list[str], job_id: str"
+    "plan_id: str, records: ReconcileMedicationsBody, message: ProcessMessageBody, codes: list[str], job_id: str,"
+    " access_token: str"
 )
 
 
diff --git a/src/haau3/_body.py b/src/haau3/_body.py
index 0dbde1a..d2d664d 100644
--- a/src/haau3/_body.py
+++ b/src/haau3/_body.py
@@ -4,11 +4,13 @@
 patient's data. So from the moment the SDK reads a body until it hands the answer back, the body
 lives in a `Hidden`: its repr is `<body hidden>`, so a traceback that shows each frame's local
 variables (`traceback`'s `capture_locals`, or an error reporter that records them) shows that and
-nothing else. The same goes for a request body, and for the key in a `Secret`.
+nothing else. The same goes for a request body, for the key in a `Secret`, and for the headers a
+call's own options carry, such as a member's authorization, in `HeldHeaders`.
 """
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import Generic, NoReturn, TypeVar, final
 
 T_co = TypeVar("T_co", covariant=True)
@@ -38,6 +40,30 @@ def __reduce__(self) -> NoReturn:
         raise TypeError("a hidden body is never pickled or copied")
 
 
+@final
+class HeldHeaders:
+    """Headers a call's own options carry, by option or by header name: printed as `<headers hidden>`, never pickled."""
+
+    __slots__ = ("_values",)
+
+    def __init__(self, values: Mapping[str, str | None]) -> None:
+        self._values = dict(values)
+
+    def reveal(self) -> dict[str, str | None]:
+        return dict(self._values)
+
+    def __repr__(self) -> str:
+        return "<headers hidden>"
+
+    __str__ = __repr__
+
+    def __format__(self, format_spec: str) -> str:
+        return "<headers hidden>"
+
+    def __reduce__(self) -> NoReturn:
+        raise TypeError("held headers are never pickled or copied")
+
+
 @final
 class Secret:
     """The API key: its repr, str and format are `<key hidden>`, and it is never pickled."""
diff --git a/src/haau3/_methods.py b/src/haau3/_methods.py
index 1f25ede..e90a697 100644
--- a/src/haau3/_methods.py
+++ b/src/haau3/_methods.py
@@ -13,7 +13,7 @@
 
 from . import fhir
 from ._batch import BatchResult, Call
-from ._body import Hidden
+from ._body import HeldHeaders, Hidden
 from ._components import (
     ListPublishersResponse,
     ListServiceTypesResponse,
@@ -389,6 +389,7 @@ def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -399,11 +400,17 @@ def process_message(
         FHIR system-level operation `$process-message`, as the CARIN Consumer Real-Time Pharmacy Benefit Check (STU2 ballot, `2.0.0-ballot`) specifies. Not yet open to customers: while its price sources are being licensed, every request from a customer's organization, with or without patient details, is refused with `403` `forbidden`. POST a FHIR `Bundle` of type `message` whose first entry is a MessageHeader with one of two events. `rtpbc-request-non-phi` asks for a medication's price without patient details: a Claim naming the product (an NDC of 11 digits with no dashes, or an RxNorm code) and the quantity, with the patient and the coverage masked, and a pharmacy, up to three ZIP codes, or both. It is answered by price sources: Cost Plus Drugs (its mail order and the Team Cuban Card) and ClixRx. `rtpbc-request` asks what a medication would cost a member under their coverage: the member's Patient and Coverage, with the payer's identifier in `payor.identifier`, the prescription and its prescriber, and a pharmacy. It is answered by the member's insurer, found by the payer's Payer ID: a `payor.identifier` whose `type` is `payerid` from `http://hl7.org/fhir/us/carin-bb/CodeSystem/C4BBIdentifierType`. An insurer that answers only with the member's own authorization is sent the access token from the member's login with that insurer, in the `Payer-Authorization` header, for that one request; it is never stored, logged or sent anywhere else. No insurer is connected yet. The answer is a `message` Bundle whose MessageHeader answers the request's, with one ClaimResponse that carries either prices and coverage in `item` or the reason there are none in `error`, and for a member's request the request's Patient as it was sent. With prices, `item` is the lowest price at a pharmacy near the ZIP codes or at the pharmacy named, every price is also an `addItem` alternative naming its pharmacy by an Organization in the Bundle and its price source in `programCode`, from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-price-source`, and `processNote` says where each price came from, when, and which free discount card pays it. Each price repeats the request's product coding, which CARIN requires to carry a display: an RxNorm code sent without one is answered with the display haau3's RxNorm release gives it, and an NDC needs its display sent with it. A check no connected source can answer carries `no-responder-for-coverage`, `no-price-source` or `source-not-available-to-caller` from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-processing-code`, and a member's request to an insurer that needs the member's authorization carries `payer-authorization-required` when none was sent and `payer-authorization-rejected` when the insurer refused it. A price is an estimate; the pharmacy confirms the price. A member's request receives patient data, so send it only under an executed agreement. Nothing a request carries is stored or logged, apart from the request's ids, and every answer is sent with `Cache-Control: no-store`. The operation takes no query parameters and is not offered inside a batch. The contract is published at https://fhir.haau3.com/pharmacy-benefits.html.
 
         `POST /v1/fhir/r4/$process-message`, https://docs.haau3.com/api-reference/pharmacy-benefits/check-what-a-medication-costs-pharmacy-benefit-check
+
+        Headers it declares, each a keyword of its own:
+
+        - `payer_authorization` (`Payer-Authorization`): A member's own authorization at their insurer, for a member's request (event `rtpbc-request`) to an insurer that answers only with it: `Bearer` and the access token your app obtained from the member's login with that insurer, as an `Authorization` header carries one. It is forwarded once, to that insurer, for this request, and is never stored, logged or sent anywhere else. Without it, such a request is answered `payer-authorization-required`; a token the insurer refuses is answered `payer-authorization-rejected`. A request without patient details that carries it is refused. Checked against the form the API takes for it, at most 4096 characters, before sending; a value it does not take is refused without being repeated, and the keyword wins over a `Payer-Authorization` in `extra_headers`. Held from the moment the call takes it where nothing prints it.
         """
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return self._engine.call(
-            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
         ).data
 
     def read_endpoint(
@@ -1951,6 +1958,7 @@ async def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -1961,12 +1969,18 @@ async def process_message(
         FHIR system-level operation `$process-message`, as the CARIN Consumer Real-Time Pharmacy Benefit Check (STU2 ballot, `2.0.0-ballot`) specifies. Not yet open to customers: while its price sources are being licensed, every request from a customer's organization, with or without patient details, is refused with `403` `forbidden`. POST a FHIR `Bundle` of type `message` whose first entry is a MessageHeader with one of two events. `rtpbc-request-non-phi` asks for a medication's price without patient details: a Claim naming the product (an NDC of 11 digits with no dashes, or an RxNorm code) and the quantity, with the patient and the coverage masked, and a pharmacy, up to three ZIP codes, or both. It is answered by price sources: Cost Plus Drugs (its mail order and the Team Cuban Card) and ClixRx. `rtpbc-request` asks what a medication would cost a member under their coverage: the member's Patient and Coverage, with the payer's identifier in `payor.identifier`, the prescription and its prescriber, and a pharmacy. It is answered by the member's insurer, found by the payer's Payer ID: a `payor.identifier` whose `type` is `payerid` from `http://hl7.org/fhir/us/carin-bb/CodeSystem/C4BBIdentifierType`. An insurer that answers only with the member's own authorization is sent the access token from the member's login with that insurer, in the `Payer-Authorization` header, for that one request; it is never stored, logged or sent anywhere else. No insurer is connected yet. The answer is a `message` Bundle whose MessageHeader answers the request's, with one ClaimResponse that carries either prices and coverage in `item` or the reason there are none in `error`, and for a member's request the request's Patient as it was sent. With prices, `item` is the lowest price at a pharmacy near the ZIP codes or at the pharmacy named, every price is also an `addItem` alternative naming its pharmacy by an Organization in the Bundle and its price source in `programCode`, from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-price-source`, and `processNote` says where each price came from, when, and which free discount card pays it. Each price repeats the request's product coding, which CARIN requires to carry a display: an RxNorm code sent without one is answered with the display haau3's RxNorm release gives it, and an NDC needs its display sent with it. A check no connected source can answer carries `no-responder-for-coverage`, `no-price-source` or `source-not-available-to-caller` from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-processing-code`, and a member's request to an insurer that needs the member's authorization carries `payer-authorization-required` when none was sent and `payer-authorization-rejected` when the insurer refused it. A price is an estimate; the pharmacy confirms the price. A member's request receives patient data, so send it only under an executed agreement. Nothing a request carries is stored or logged, apart from the request's ids, and every answer is sent with `Cache-Control: no-store`. The operation takes no query parameters and is not offered inside a batch. The contract is published at https://fhir.haau3.com/pharmacy-benefits.html.
 
         `POST /v1/fhir/r4/$process-message`, https://docs.haau3.com/api-reference/pharmacy-benefits/check-what-a-medication-costs-pharmacy-benefit-check
+
+        Headers it declares, each a keyword of its own:
+
+        - `payer_authorization` (`Payer-Authorization`): A member's own authorization at their insurer, for a member's request (event `rtpbc-request`) to an insurer that answers only with it: `Bearer` and the access token your app obtained from the member's login with that insurer, as an `Authorization` header carries one. It is forwarded once, to that insurer, for this request, and is never stored, logged or sent anywhere else. Without it, such a request is answered `payer-authorization-required`; a token the insurer refuses is answered `payer-authorization-rejected`. A request without patient details that carries it is refused. Checked against the form the API takes for it, at most 4096 characters, before sending; a value it does not take is refused without being repeated, and the keyword wins over a `Payer-Authorization` in `extra_headers`. Held from the moment the call takes it where nothing prints it.
         """
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return (
             await self._engine.call(
-                PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+                PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
             )
         ).data
 
@@ -3460,6 +3474,7 @@ def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -3468,8 +3483,10 @@ def process_message(
         """`Haau3.process_message`, returning a `Response` with the request id and timing as well as the answer."""
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return self._engine.call(
-            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
         )
 
     def read_endpoint(
@@ -4544,6 +4561,7 @@ async def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -4552,8 +4570,10 @@ async def process_message(
         """`AsyncHaau3.process_message`, returning a `Response` with the request id and timing as well as the answer."""
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return await self._engine.call(
-            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
         )
 
     async def read_endpoint(
diff --git a/src/haau3/_operation.py b/src/haau3/_operation.py
index 9d1ab3c..51f4aa4 100644
--- a/src/haau3/_operation.py
+++ b/src/haau3/_operation.py
@@ -8,6 +8,20 @@
 T = TypeVar("T")
 
 
+@final
+@dataclass(frozen=True)
+class DeclaredHeader:
+    """A header parameter an operation declares, sent from the call's keyword of its name in snake_case."""
+
+    wire: str
+    """The header, as the spec names it: `Payer-Authorization`."""
+    option: str
+    """The keyword it is sent from: `payer_authorization`."""
+    max_length: int | None = None
+    pattern: str | None = None
+    """The spec's pattern, an ECMAScript regular expression the generator checked Python reads alike."""
+
+
 @final
 @dataclass(frozen=True)
 class Operation(Generic[T]):
@@ -21,6 +35,8 @@ class Operation(Generic[T]):
     """The path in the spec, such as `/v1/fhir/r4/InsurancePlan/{id}`."""
     expects: tuple[str, ...] = ()
     """The FHIR resource types a success may be. Empty checks no type (Scheduling's answers)."""
+    headers: tuple[DeclaredHeader, ...] = ()
+    """The header parameters it declares, each sent from a keyword of the call's own."""
 
     @property
     def label(self) -> str:
diff --git a/src/haau3/_operations.py b/src/haau3/_operations.py
index af0a529..6e06a88 100644
--- a/src/haau3/_operations.py
+++ b/src/haau3/_operations.py
@@ -18,7 +18,7 @@
     SearchProviderLocationsResponse,
     SearchSlotsResponse,
 )
-from ._operation import Operation
+from ._operation import DeclaredHeader, Operation
 
 SPEC_VERSION: Final[str] = "1.0.0-preview.12"
 """The version of the API's spec this SDK was generated from."""
@@ -53,7 +53,16 @@
 LIST_PUBLISHERS: Final[Operation[ListPublishersResponse]] = Operation("GET", "/v1/scheduling/publishers", ())
 LIST_SERVICE_TYPES: Final[Operation[ListServiceTypesResponse]] = Operation("GET", "/v1/scheduling/service-types", ())
 LIST_SPECIALTIES: Final[Operation[ListSpecialtiesResponse]] = Operation("GET", "/v1/scheduling/specialties", ())
-PROCESS_MESSAGE: Final[Operation[fhir.Bundle]] = Operation("POST", "/v1/fhir/r4/$process-message", ("Bundle",))
+PROCESS_MESSAGE: Final[Operation[fhir.Bundle]] = Operation(
+    "POST",
+    "/v1/fhir/r4/$process-message",
+    ("Bundle",),
+    headers=(
+        DeclaredHeader(
+            "Payer-Authorization", "payer_authorization", 4096, "^[Bb][Ee][Aa][Rr][Ee][Rr] +[A-Za-z0-9\\-._~+/]+=*$"
+        ),
+    ),
+)
 READ_ENDPOINT: Final[Operation[fhir.Endpoint]] = Operation("GET", "/v1/fhir/r4/Endpoint/{id}", ("Endpoint",))
 READ_HEALTHCARE_SERVICE: Final[Operation[fhir.HealthcareService]] = Operation(
     "GET", "/v1/fhir/r4/HealthcareService/{id}", ("HealthcareService",)
diff --git a/src/haau3/_response.py b/src/haau3/_response.py
index d1c4a3d..ef38814 100644
--- a/src/haau3/_response.py
+++ b/src/haau3/_response.py
@@ -8,6 +8,8 @@
 
 import httpx2
 
+from ._body import HeldHeaders
+
 T_co = TypeVar("T_co", covariant=True)
 
 
@@ -59,3 +61,5 @@ class Options:
     max_retries: int | None = None
     correlation_id: str | None = None
     extra_headers: Mapping[str, str] | None = field(default=None, repr=False)
+    declared: HeldHeaders | None = field(default=None, repr=False)
+    """The keywords of the headers the operation declares, held where nothing prints them."""
diff --git a/src/haau3/_transport.py b/src/haau3/_transport.py
index 2fe8a06..cfa6d3d 100644
--- a/src/haau3/_transport.py
+++ b/src/haau3/_transport.py
@@ -7,6 +7,7 @@
 
 from __future__ import annotations
 
+import re
 import sys
 import time
 from collections.abc import Iterable, Sequence
@@ -17,11 +18,11 @@
 import httpx2
 
 from ._batch import BatchResult, batch_bundle, read_batch
-from ._body import Hidden, Secret
+from ._body import HeldHeaders, Hidden, Secret
 from ._encode import FHIR_BASE, QueryValue, encode_query, fill_path, is_fhir, is_uuid, json_bytes, path_of, url_on_base
 from ._errors import Haau3Error, NoAnswerError, NoAnswerReason
 from ._judge import Context, detail, judge, parse_body, retry_after_seconds, wait_after_answer, wait_after_failure
-from ._operation import Operation
+from ._operation import DeclaredHeader, Operation
 from ._response import Options, RawResponse, Response
 from ._version import __version__
 
@@ -148,8 +149,50 @@ class _AttemptTimedOut(Exception):
     """A sync attempt's body was still arriving at its deadline."""
 
 
+def _problem(header: DeclaredHeader, declared: HeldHeaders) -> str | None:
+    """What is wrong with one declared header's value, in words that never carry it; None when it may go.
+
+    Its own frame, so the value is gone before anything is raised: a traceback that shows each frame's
+    local variables shows `declared`, which prints as `<headers hidden>`, and nothing else.
+    """
+    value = declared.reveal().get(header.option)
+    if value is None:
+        return None
+    if header.max_length is not None and len(value) > header.max_length:
+        return f"is longer than the {header.max_length} characters the API takes in {header.wire}."
+    # A header value never holds a line break, and Python's `$` would match before a final one.
+    if "\n" in value or "\r" in value or (header.pattern is not None and re.search(header.pattern, value) is None):
+        return f"is not in the form the API takes in {header.wire}, which the keyword's description gives."
+    return None
+
+
+def declared_headers(operation: Operation[Any], options: Options) -> HeldHeaders | None:
+    """The headers `operation` declares, from the call's own keywords, by header name and lower-cased.
+
+    Each value set is checked against the spec's schema for it, and one the API would refuse is refused
+    here, before anything is sent, in a message that names the keyword, never the value: a header such
+    as `Payer-Authorization` carries a credential.
+    """
+    if options.declared is None or not operation.headers:
+        return None
+    for header in operation.headers:
+        problem = _problem(header, options.declared)
+        if problem is not None:
+            raise Haau3Error(f"{operation.label} was not sent: {header.option} {problem}")
+    values = options.declared.reveal()
+    return HeldHeaders(
+        {h.wire.lower(): values[h.option] for h in operation.headers if values.get(h.option) is not None}
+    )
+
+
 def prepare(
-    config: Config, method: Method, url: str, content: Hidden[bytes] | None, options: Options, name: str
+    config: Config,
+    method: Method,
+    url: str,
+    content: Hidden[bytes] | None,
+    options: Options,
+    name: str,
+    declared: HeldHeaders | None = None,
 ) -> Prepared:
     """Headers and limits for a request. A `correlation_id` that is not a UUID is refused before the key is touched."""
     if options.correlation_id is not None and not is_uuid(options.correlation_id):
@@ -168,6 +211,10 @@ def prepare(
         headers["content-type"] = FHIR_JSON if fhir else "application/json"
     for header, value in (options.extra_headers or {}).items():
         headers[header.lower()] = value
+    # A header the operation declares is sent from its own keyword, over the same one in extra_headers.
+    for wire, held in (declared.reveal() if declared is not None else {}).items():
+        if held is not None:
+            headers[wire] = held
     if options.correlation_id is not None:
         headers["x-request-id"] = options.correlation_id
     return Prepared(
@@ -287,7 +334,8 @@ def call(
         options: Options,
     ) -> Response[T]:
         url = self.operation_url(operation, path_values, query)
-        sent = self.send(operation.method, url, body_bytes(body), options, operation.label)
+        declared = declared_headers(operation, options)
+        sent = self.send(operation.method, url, body_bytes(body), options, operation.label, declared)
         return sent.response(cast("T", answer_of(operation.label, operation.expects, sent).reveal()))
 
     def batch(self, calls: Sequence[object], options: Options) -> Response[tuple[BatchResult[Any], ...]]:
@@ -306,8 +354,16 @@ def request(
         url = self.resolve(path, query)
         return raw_response(self.send(method, url, raw_content(body), options, self.name(method, url)))
 
-    def send(self, method: Method, url: str, content: Hidden[bytes] | None, options: Options, name: str) -> Sent:
-        prepared = prepare(self._config, method, url, content, options, name)
+    def send(
+        self,
+        method: Method,
+        url: str,
+        content: Hidden[bytes] | None,
+        options: Options,
+        name: str,
+        declared: HeldHeaders | None = None,
+    ) -> Sent:
+        prepared = prepare(self._config, method, url, content, options, name, declared)
         started = time.monotonic()
         attempt = 0
         while True:
@@ -385,7 +441,8 @@ async def call(
         options: Options,
     ) -> Response[T]:
         url = self.operation_url(operation, path_values, query)
-        sent = await self.send(operation.method, url, body_bytes(body), options, operation.label)
+        declared = declared_headers(operation, options)
+        sent = await self.send(operation.method, url, body_bytes(body), options, operation.label, declared)
         return sent.response(cast("T", answer_of(operation.label, operation.expects, sent).reveal()))
 
     async def batch(self, calls: Sequence[object], options: Options) -> Response[tuple[BatchResult[Any], ...]]:
@@ -404,8 +461,16 @@ async def request(
         url = self.resolve(path, query)
         return raw_response(await self.send(method, url, raw_content(body), options, self.name(method, url)))
 
-    async def send(self, method: Method, url: str, content: Hidden[bytes] | None, options: Options, name: str) -> Sent:
-        prepared = prepare(self._config, method, url, content, options, name)
+    async def send(
+        self,
+        method: Method,
+        url: str,
+        content: Hidden[bytes] | None,
+        options: Options,
+        name: str,
+        declared: HeldHeaders | None = None,
+    ) -> Sent:
+        prepared = prepare(self._config, method, url, content, options, name, declared)
         started = time.monotonic()
         attempt = 0
         while True:
diff --git a/tests/test_generate.py b/tests/test_generate.py
index f5a0c2e..6d8494b 100644
--- a/tests/test_generate.py
+++ b/tests/test_generate.py
@@ -154,6 +154,43 @@ def test_the_generator_refuses_a_parameter_it_cannot_name_or_type(parameters: li
         generate.Spec(_mini(parameters))
 
 
+def _header(**changes: object) -> dict[str, object]:
+    return {"name": "X-Example-Option", "in": "header", "schema": {"type": "string"}, **changes}
+
+
+def test_an_optional_header_is_a_keyword_of_the_operations_own() -> None:
+    op = next(
+        o
+        for o in generate.Spec(_mini([_header(schema={"type": "string", "maxLength": 9})])).ops
+        if o.id == "listPublishers"
+    )
+    assert [(h.wire, h.python, h.max_length) for h in op.headers] == [("X-Example-Option", "x_example_option", 9)]
+
+
+@pytest.mark.parametrize(
+    ("parameters", "words"),
+    [
+        ([_header(required=True)], "required header"),
+        ([{"name": "session", "in": "cookie", "schema": {"type": "string"}}], "in cookie"),
+        ([_header(name="Timeout")], "clash"),
+        ([_header(name="Name"), {"name": "name", "in": "query", "schema": {"type": "string"}}], "clash"),
+        ([_header(schema={"type": "integer"})], "not a string"),
+        ([_header(schema={"type": "string", "pattern": "(unclosed"})], "missing"),
+    ],
+    ids=["required", "a cookie", "an option's name", "a query parameter's name", "not a string", "a bad pattern"],
+)
+def test_the_generator_stops_on_a_header_it_cannot_send(parameters: list[dict[str, object]], words: str) -> None:
+    with pytest.raises(Exception, match=words):
+        generate.Spec(_mini(parameters))
+
+
+def test_a_header_on_an_operation_a_batch_can_carry_stops_the_generator() -> None:
+    spec: dict[str, Any] = json.loads(json.dumps(SPEC))
+    spec["paths"]["/v1/fhir/r4/metadata"]["get"].setdefault("parameters", []).append(_header())
+    with pytest.raises(ValueError, match="whose entries carry no headers"):
+        generate.Spec(spec)
+
+
 def test_the_generator_refuses_a_spec_without_the_batch() -> None:
     spec = json.loads(json.dumps(SPEC))
     del spec["paths"]["/v1/fhir/r4"]
diff --git a/tests/test_header_options.py b/tests/test_header_options.py
new file mode 100644
index 0000000..327845e
--- /dev/null
+++ b/tests/test_header_options.py
@@ -0,0 +1,144 @@
+"""A header an operation declares is a keyword of the call's own: process_message's payer_authorization.
+
+It is sent as Payer-Authorization, checked against the spec's schema before anything is sent, wins
+over the same header in extra_headers, and is held where nothing prints it, a traceback's local
+variables included.
+"""
+
+from __future__ import annotations
+
+import pickle
+import traceback
+from typing import Any
+
+import pytest
+
+from haau3 import Haau3Error, RefusedError
+from haau3._body import HeldHeaders
+
+from .helpers import Client, Recorder, answer
+
+MESSAGE: dict[str, Any] = {"resourceType": "Bundle", "type": "message", "entry": []}
+ANSWER = {"resourceType": "Bundle", "type": "message", "entry": []}
+# A token no error, message or printout may ever carry.
+TOKEN = "eyJ0b2tlbi10aGF0LW11c3QtbmV2ZXItYmUtcHJpbnRlZA"
+
+
+def printed(error: BaseException) -> str:
+    """The error as anything would print it, with the local variables of every frame of the SDK's own.
+
+    The caller's frames are left out: a value the caller holds in a variable of its own is the caller's
+    to keep out of a log, and the test's helpers hold the keyword in theirs.
+    """
+    tb = error.__traceback__
+    while tb is not None and "/src/haau3/" not in tb.tb_frame.f_code.co_filename:
+        tb = tb.tb_next
+    assert tb is not None, "the error was raised in no frame of the SDK's"
+    sdk = traceback.TracebackException(type(error), error, tb, capture_locals=True)
+    return "\n".join(["".join(sdk.format()), repr(error), str(error), repr(vars(error))])
+
+
+@pytest.mark.anyio
+async def test_it_is_sent_as_payer_authorization_beside_the_key(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=f"Bearer {TOKEN}")
+    assert recorder.last.headers["payer-authorization"] == f"Bearer {TOKEN}"
+    assert recorder.last.headers["authorization"].startswith("Bearer haau3_sk_")
+
+
+@pytest.mark.anyio
+async def test_nothing_is_sent_when_it_is_not_given(kind: str) -> None:
+    # The control: the header is the keyword's doing.
+    recorder = Recorder(answer(200, ANSWER))
+    client = Client(kind, recorder)
+    await client("process_message", MESSAGE)
+    await client("process_message", MESSAGE, timeout=5)
+    assert len(recorder.requests) == 2
+    assert all("payer-authorization" not in r.headers for r in recorder.requests)
+
+
+@pytest.mark.anyio
+async def test_any_case_of_the_scheme_is_taken_as_the_api_takes_it(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=f"bearer  {TOKEN}")
+    assert recorder.last.headers["payer-authorization"] == f"bearer  {TOKEN}"
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    ("value", "words"),
+    [
+        (TOKEN, "is not in the form the API takes in Payer-Authorization"),
+        (f"Basic {TOKEN}", "is not in the form the API takes in Payer-Authorization"),
+        ("", "is not in the form the API takes in Payer-Authorization"),
+        (f"Bearer {TOKEN}\n", "is not in the form the API takes in Payer-Authorization"),
+        ("Bearer " + "a" * 4090, "is longer than the 4096 characters the API takes in Payer-Authorization"),
+    ],
+    ids=["a bare token", "another scheme", "an empty value", "a final line break", "4,097 characters"],
+)
+async def test_a_value_the_api_would_refuse_is_refused_before_sending(kind: str, value: str, words: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    error = await Client(kind, recorder).raises("process_message", MESSAGE, payer_authorization=value)
+    assert isinstance(error, Haau3Error)
+    assert recorder.requests == []
+    assert str(error).startswith(f"POST /v1/fhir/r4/$process-message was not sent: payer_authorization {words}")
+    if value:
+        assert value.strip()[-20:] not in printed(error)
+    assert TOKEN not in printed(error)
+    # The control: the SDK's frames are printed with their locals, the held keyword among them.
+    assert "declared = <headers hidden>" in printed(error)
+
+
+@pytest.mark.anyio
+async def test_4096_characters_the_apis_own_limit_are_taken(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    at_limit = "Bearer " + "a" * 4089
+    assert len(at_limit) == 4096
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=at_limit)
+    assert recorder.last.headers["payer-authorization"] == at_limit
+
+
+@pytest.mark.anyio
+async def test_it_wins_over_the_same_header_in_extra_headers(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    await Client(kind, recorder)(
+        "process_message",
+        MESSAGE,
+        payer_authorization=f"Bearer {TOKEN}",
+        extra_headers={"PAYER-AUTHORIZATION": "Bearer from-extra-headers"},
+    )
+    assert recorder.last.headers.get_list("payer-authorization") == [f"Bearer {TOKEN}"]
+
+
+@pytest.mark.anyio
+async def test_it_is_sent_again_on_a_retry(kind: str) -> None:
+    recorder = Recorder(answer(503, None), answer(200, ANSWER))
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=f"Bearer {TOKEN}", max_retries=1)
+    assert [r.headers["payer-authorization"] for r in recorder.requests] == [f"Bearer {TOKEN}"] * 2
+
+
+@pytest.mark.anyio
+async def test_no_error_the_api_answers_carries_it_however_it_is_printed(kind: str) -> None:
+    outcome = {"resourceType": "OperationOutcome", "issue": [{"severity": "error", "code": "invalid"}]}
+    recorder = Recorder(answer(400, outcome))
+    error = await Client(kind, recorder).raises("process_message", MESSAGE, payer_authorization=f"Bearer {TOKEN}")
+    assert isinstance(error, RefusedError)
+    assert TOKEN not in printed(error)
+    assert "declared = <headers hidden>" in printed(error)
+
+
+def test_the_holder_never_prints_or_pickles_what_it_holds() -> None:
+    held = HeldHeaders({"payer_authorization": f"Bearer {TOKEN}"})
+    for text in (repr(held), str(held), f"{held}", f"{held!r:>40}"):
+        assert TOKEN not in text
+        assert "<headers hidden>" in text
+    with pytest.raises(TypeError):
+        pickle.dumps(held)
+
+
+@pytest.mark.anyio
+async def test_only_the_operation_that_declares_it_takes_the_keyword(kind: str) -> None:
+    recorder = Recorder(answer(200, {"resourceType": "InsurancePlan", "id": "H1"}))
+    with pytest.raises(TypeError):
+        await Client(kind, recorder)("read_insurance_plan", "H1", payer_authorization=f"Bearer {TOKEN}")
+    assert recorder.requests == []
diff --git a/tests/test_readme.py b/tests/test_readme.py
index 0cbef25..1eeecbd 100644
--- a/tests/test_readme.py
+++ b/tests/test_readme.py
@@ -45,6 +45,7 @@ def _arguments() -> dict[str, Any]:
         "message": message,
         "codes": ["2345-7", "2160-0"],
         "job_id": str(uuid.uuid4()),
+        "access_token": "eyJhbGciOiJub25lIn0.e30.example",
     }