From 081cc138775390c9eeae22b5aeb134196f2526cf Mon Sep 17 00:00:00 2001
From: Brian K Fung <64922294+briankfung@users.noreply.github.com>
Date: Fri, 23 Oct 2026 00:25:04 -0400
Subject: [PATCH 1/2] feat: a header an operation declares is a keyword of the
 call's own

The generator now reads an operation's optional header parameters, where it skipped them before.
Each becomes a keyword of that method's own, named from the header in snake_case and typed from the
spec, so process_message takes payer_authorization, sent as Payer-Authorization. Every existing
call works as it did.

A header can carry a credential, so the method holds the keyword at once in HeldHeaders, which
prints as <headers hidden> and is never pickled, and deletes the name, as it already does for a
request body. A traceback that records each frame's local variables shows nothing of it. Before
sending, the value is checked against the parameter's schema (its maxLength and pattern) in a frame
of its own. A value the API would refuse is refused in a message that names the keyword, never the
value. The keyword wins over the same header in extra_headers, as correlation_id does for
X-Request-Id.

The generator stops on a required header, on a parameter in a cookie, on a header whose name clashes
with a query parameter or a call option, on a pattern Python cannot read, and on a header declared by
an operation a batch can carry. api.md, each method's docstring and the README's Options say how it
works.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                |  11 ++++
 api.md                   |   3 ++
 scripts/generate.py      | 108 ++++++++++++++++++++++++++++++++++++---
 scripts/readme_blocks.py |   6 ++-
 src/haau3/_body.py       |  28 +++++++++-
 src/haau3/_methods.py    |  30 +++++++++--
 src/haau3/_operation.py  |  16 ++++++
 src/haau3/_operations.py |  13 ++++-
 src/haau3/_response.py   |   4 ++
 src/haau3/_transport.py  |  83 ++++++++++++++++++++++++++----
 10 files changed, 276 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index 32e0edc..04de762 100644
--- a/README.md
+++ b/README.md
@@ -129,6 +129,17 @@ that call only:
 client.search_slots(state="MA", timeout=10, max_retries=0)
 ```
 
+An operation that declares a header of its own takes it as one more keyword, named from the header
+and typed from the spec. `process_message` takes `payer_authorization`, sent as
+`Payer-Authorization`: a member's own authorization at their insurer, `Bearer` and the access token
+your app got from the member's login there. The SDK checks it against the form the API takes before
+sending, refuses one the API would not take without repeating it, and holds it where nothing prints
+it, a traceback's local variables included.
+
+```python
+checked = client.process_message(message, payer_authorization=f"Bearer {access_token}")
+```
+
 `http_client` passes anything [httpx2](https://github.com/pydantic/httpx2) takes: a proxy,
 certificates, limits, event hooks, a transport. The SDK's own method, URL, headers, body and
 timeout always win, it never follows a redirect, and it never closes a client you pass.
diff --git a/api.md b/api.md
index 6c9d69b..db102d2 100644
--- a/api.md
+++ b/api.md
@@ -10,6 +10,9 @@ snake_case (`name:contains` is `name_contains`, `_count` is `count`); each metho
 both. Every method also takes the per-call options `timeout`, `max_retries`, `correlation_id` and
 `extra_headers`, and `client.with_response.<method>(...)` gives the request id and timing too.
 
+An operation that declares a header takes it as one more keyword, named from the header in snake_case and
+checked before sending: `process_message` takes `payer_authorization`, sent as `Payer-Authorization`.
+
 `batch()` sends several of these as one request, each with its own answer or error, from the entries
 `haau3.calls` makes. It takes every operation on the FHIR base except `fhir_batch`, `process_message` and `reconcile_medications`: 29 of the
 37. See the README's "Several requests in one".
diff --git a/scripts/generate.py b/scripts/generate.py
index 32245ed..cce01d5 100644
--- a/scripts/generate.py
+++ b/scripts/generate.py
@@ -32,6 +32,7 @@
 import hashlib
 import json
 import os
+import re
 import subprocess
 import sys
 import tempfile
@@ -89,6 +90,17 @@ class Param:
     description: str
 
 
+@dataclass
+class Header:
+    """An optional header parameter, sent from a keyword of the call's own named from it."""
+
+    wire: str
+    python: str
+    description: str
+    max_length: int | None
+    pattern: str | None
+
+
 @dataclass
 class Op:
     id: str
@@ -103,6 +115,7 @@ class Op:
     body: str | None
     response: str
     expects: list[str]
+    headers: list[Header] = field(default_factory=list)
     batchable: bool = False
     name: str = field(init=False)
     const: str = field(init=False)
@@ -202,6 +215,36 @@ def _query_type(self, op_id: str, param: Json) -> str:
             f"{op_id}: the query parameter {param.get('name')} has a schema the generator does not read: {schema}"
         )
 
+    @staticmethod
+    def _headers(op_id: str, params: list[Json]) -> list[Header]:
+        """The optional header parameters. A required one, or a parameter in a cookie, stops the generator."""
+        headers: list[Header] = []
+        for p in params:
+            if p["in"] not in ("path", "query", "header"):
+                raise ValueError(f"{op_id}: a parameter in {p['in']}, which the generator does not send")
+            if p["in"] != "header":
+                continue
+            if p.get("required"):
+                raise ValueError(
+                    f"{op_id}: the required header {p['name']}, which a generated method cannot complete without"
+                )
+            schema = p.get("schema") or {}
+            if schema.get("type") != "string":
+                raise ValueError(f"{op_id}: the header {p['name']} is not a string, the only kind the generator sends")
+            pattern = schema.get("pattern")
+            if pattern is not None:
+                re.compile(pattern)  # The spec's ECMAScript pattern, which this one must read as Python does.
+            headers.append(
+                Header(
+                    wire=p["name"],
+                    python=naming.python_name(p["name"]),
+                    description=" ".join((p.get("description") or "").split()),
+                    max_length=schema.get("maxLength"),
+                    pattern=pattern,
+                )
+            )
+        return headers
+
     def _operations(self) -> list[Op]:
         docs = naming.DocsUrls()
         ops: list[Op] = []
@@ -222,10 +265,11 @@ def _operations(self) -> list[Op]:
                     for p in params
                     if p["in"] == "query"
                 ]
-                names = [p.python for p in query]
+                headers = self._headers(op["operationId"], params)
+                names = [p.python for p in query] + [h.python for h in headers]
                 clashes = {n for n in names if names.count(n) > 1} | (set(names) & {*OPTION_NAMES, "self", "body"})
                 if clashes:
-                    raise ValueError(f"{op['operationId']}: query parameters clash as {sorted(clashes)}")
+                    raise ValueError(f"{op['operationId']}: parameters clash as {sorted(clashes)}")
                 tag = (op.get("tags") or ["Other"])[0]
                 ops.append(
                     Op(
@@ -241,6 +285,7 @@ def _operations(self) -> list[Op]:
                         body=self._body(op),
                         response=self._response(op),
                         expects=self._expects(op),
+                        headers=headers,
                     )
                 )
         for op in ops:
@@ -248,6 +293,11 @@ def _operations(self) -> list[Op]:
                 raise ValueError(f"{op.id} is {op.method}; the SDK sends GET and POST only")
         for op in ops:
             mark = self.spec["paths"][op.path][op.method.lower()].get(BATCHABLE)
+            if op.headers and op.path.startswith("/v1/fhir/r4/") and mark is not False:
+                # A batch entry is one request inside the batch's body, which carries no headers of its own.
+                raise ValueError(
+                    f"{op.id} declares the header {op.headers[0].wire} and can go in a batch, whose entries carry no headers"
+                )
             if mark is not None and mark is not False:
                 raise ValueError(f"{op.id} carries {BATCHABLE}: {mark!r}, where the spec defines only false")
             if mark is False and not op.path.startswith("/v1/fhir/r4/"):
@@ -275,6 +325,7 @@ def _signature(op: Op, *, for_call: bool = False) -> str:
     if positional:
         parts.append("/")
     keywords = [f"{p.python}: {p.type}" if p.required else f"{p.python}: {p.type} | None = None" for p in op.query]
+    keywords += [f"{h.python}: str | None = None" for h in op.headers]
     if not for_call:
         keywords += [
             "timeout: float | None = None",
@@ -305,6 +356,16 @@ def _method_doc(op: Op) -> str:
             required = " Required." if p.required else ""
             lines.append(f"- `{p.python}`{wire}:{required} {p.description}".rstrip())
         parts.append("\n".join(lines))
+    if op.headers:
+        lines = ["Headers it declares, each a keyword of its own:", ""]
+        for h in op.headers:
+            limit = f", at most {h.max_length} characters" if h.max_length is not None else ""
+            lines.append(
+                f"- `{h.python}` (`{h.wire}`): {h.description} Checked against the form the API takes for it{limit},"
+                f" before sending; a value it does not take is refused without being repeated, and the keyword wins over"
+                f" a `{h.wire}` in `extra_headers`. Held from the moment the call takes it where nothing prints it.".strip()
+            )
+        parts.append("\n".join(lines))
     return "\n\n".join(parts)
 
 
@@ -313,6 +374,19 @@ def _hide_body(op: Op, indent: str) -> list[str]:
     return [f"{indent}hidden: Hidden[object] = Hidden(body)", f"{indent}del body"] if op.body else []
 
 
+def _hide_headers(op: Op, indent: str) -> list[str]:
+    # A declared header can carry a credential, such as a member's authorization: held at once, the same way.
+    if not op.headers:
+        return []
+    values = ", ".join(f"{h.python!r}: {h.python}" for h in op.headers)
+    return [f"{indent}declared = HeldHeaders({{{values}}})", f"{indent}del {', '.join(h.python for h in op.headers)}"]
+
+
+def _options(op: Op) -> str:
+    held = ", declared" if op.headers else ""
+    return f"Options(timeout, max_retries, correlation_id, extra_headers{held})"
+
+
 def _methods_class(ops: list[Op], *, name: str, asynchronous: bool, with_response: bool) -> str:
     client = "AsyncHaau3" if asynchronous else "Haau3"
     engine = "AsyncEngine" if asynchronous else "SyncEngine"
@@ -352,7 +426,8 @@ def _methods_class(ops: list[Op], *, name: str, asynchronous: bool, with_respons
         else:
             lines.append(docstring(_method_doc(op), "        "))
         lines += _hide_body(op, "        ")
-        call = f"self._engine.call({_call_arguments(op, 'hidden')}, Options(timeout, max_retries, correlation_id, extra_headers))"
+        lines += _hide_headers(op, "        ")
+        call = f"self._engine.call({_call_arguments(op, 'hidden')}, {_options(op)})"
         if asynchronous:
             call = f"(await {call})"
         lines.append(f"        return {call}{'' if with_response else '.data'}")
@@ -430,7 +505,7 @@ def methods_module(spec: Spec) -> str:
         "from typing import TYPE_CHECKING, Any, Literal, TypeVar, Union, overload\n",
         "from . import fhir",
         "from ._batch import BatchResult, Call",
-        "from ._body import Hidden",
+        "from ._body import HeldHeaders, Hidden",
         f"from ._components import {', '.join(own)}",
         f"from ._operations import {', '.join(o.const for o in ops)}",
         "from ._response import Options, Response\n",
@@ -461,13 +536,21 @@ def operations_module(spec: Spec) -> str:
         "from typing import Final, Union\n",
         "from . import fhir",
         f"from ._components import {', '.join(own)}",
-        "from ._operation import Operation\n",
+        "from ._operation import DeclaredHeader, Operation\n",
         f"SPEC_VERSION: Final[str] = {spec.spec['info']['version']!r}",
         '"""The version of the API\'s spec this SDK was generated from."""\n',
     ]
     for op in spec.ops:
         expects = "(" + "".join(f"{t!r}, " for t in op.expects) + ")"
-        lines.append(f'{op.const}: Final[Operation[{op.response}]] = Operation("{op.method}", {op.path!r}, {expects})')
+        headers = ""
+        if op.headers:
+            declared = "".join(
+                f"DeclaredHeader({h.wire!r}, {h.python!r}, {h.max_length!r}, {h.pattern!r}), " for h in op.headers
+            )
+            headers = f", headers=({declared})"
+        lines.append(
+            f'{op.const}: Final[Operation[{op.response}]] = Operation("{op.method}", {op.path!r}, {expects}{headers})'
+        )
     return "\n".join(lines) + "\n"
 
 
@@ -554,6 +637,17 @@ def _readable_signature(op: Op) -> str:
     return f"{op.name}({', '.join(args)})"
 
 
+def _header_keywords(spec: Spec) -> str:
+    """What api.md says of the keywords an operation's declared headers add."""
+    each = [f"`{op.name}` takes `{h.python}`, sent as `{h.wire}`" for op in spec.ops for h in op.headers]
+    if not each:
+        return ""
+    return (
+        "\nAn operation that declares a header takes it as one more keyword, named from the header in snake_case and\n"
+        f"checked before sending: {'; '.join(each)}.\n"
+    )
+
+
 def api_md(spec: Spec) -> str:
     tags = [t["name"] for t in spec.spec.get("tags", [])]
     text = {t["name"]: t.get("description", "") for t in spec.spec.get("tags", [])}
@@ -583,7 +677,7 @@ def api_md(spec: Spec) -> str:
 snake_case (`name:contains` is `name_contains`, `_count` is `count`); each method's docstring gives
 both. Every method also takes the per-call options `timeout`, `max_retries`, `correlation_id` and
 `extra_headers`, and `client.with_response.<method>(...)` gives the request id and timing too.
-
+{_header_keywords(spec)}
 `batch()` sends several of these as one request, each with its own answer or error, from the entries
 `haau3.calls` makes. It takes every operation on the FHIR base except {excluded}: {len(batchable)} of the
 {len(spec.ops)}. See the README's "Several requests in one".
diff --git a/scripts/readme_blocks.py b/scripts/readme_blocks.py
index bff217b..b335e2a 100644
--- a/scripts/readme_blocks.py
+++ b/scripts/readme_blocks.py
@@ -7,7 +7,8 @@
 Blocks are kept in order, so a later one uses what an earlier one made (`client`). A block that
 awaits goes into `readme_async`, the others into `readme_sync`. A block after the line
 `<!-- not run: <why> -->` is type-checked only, in `readme_not_run`. The names the README leaves to
-the reader (`plan_id`, `records`, `message`, `codes`, `job_id`) are the functions' parameters.
+the reader (`plan_id`, `records`, `message`, `codes`, `job_id`, `access_token`) are the functions'
+parameters.
 """
 
 from __future__ import annotations
@@ -25,7 +26,8 @@
 _AWAITS = re.compile(r"\bawait\b|\basync (for|with)\b")
 
 PARAMETERS = (
-    "plan_id: str, records: ReconcileMedicationsBody, message: ProcessMessageBody, codes: list[str], job_id: str"
+    "plan_id: str, records: ReconcileMedicationsBody, message: ProcessMessageBody, codes: list[str], job_id: str,"
+    " access_token: str"
 )
 
 
diff --git a/src/haau3/_body.py b/src/haau3/_body.py
index 0dbde1a..d2d664d 100644
--- a/src/haau3/_body.py
+++ b/src/haau3/_body.py
@@ -4,11 +4,13 @@
 patient's data. So from the moment the SDK reads a body until it hands the answer back, the body
 lives in a `Hidden`: its repr is `<body hidden>`, so a traceback that shows each frame's local
 variables (`traceback`'s `capture_locals`, or an error reporter that records them) shows that and
-nothing else. The same goes for a request body, and for the key in a `Secret`.
+nothing else. The same goes for a request body, for the key in a `Secret`, and for the headers a
+call's own options carry, such as a member's authorization, in `HeldHeaders`.
 """
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import Generic, NoReturn, TypeVar, final
 
 T_co = TypeVar("T_co", covariant=True)
@@ -38,6 +40,30 @@ def __reduce__(self) -> NoReturn:
         raise TypeError("a hidden body is never pickled or copied")
 
 
+@final
+class HeldHeaders:
+    """Headers a call's own options carry, by option or by header name: printed as `<headers hidden>`, never pickled."""
+
+    __slots__ = ("_values",)
+
+    def __init__(self, values: Mapping[str, str | None]) -> None:
+        self._values = dict(values)
+
+    def reveal(self) -> dict[str, str | None]:
+        return dict(self._values)
+
+    def __repr__(self) -> str:
+        return "<headers hidden>"
+
+    __str__ = __repr__
+
+    def __format__(self, format_spec: str) -> str:
+        return "<headers hidden>"
+
+    def __reduce__(self) -> NoReturn:
+        raise TypeError("held headers are never pickled or copied")
+
+
 @final
 class Secret:
     """The API key: its repr, str and format are `<key hidden>`, and it is never pickled."""
diff --git a/src/haau3/_methods.py b/src/haau3/_methods.py
index 1f25ede..e90a697 100644
--- a/src/haau3/_methods.py
+++ b/src/haau3/_methods.py
@@ -13,7 +13,7 @@
 
 from . import fhir
 from ._batch import BatchResult, Call
-from ._body import Hidden
+from ._body import HeldHeaders, Hidden
 from ._components import (
     ListPublishersResponse,
     ListServiceTypesResponse,
@@ -389,6 +389,7 @@ def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -399,11 +400,17 @@ def process_message(
         FHIR system-level operation `$process-message`, as the CARIN Consumer Real-Time Pharmacy Benefit Check (STU2 ballot, `2.0.0-ballot`) specifies. Not yet open to customers: while its price sources are being licensed, every request from a customer's organization, with or without patient details, is refused with `403` `forbidden`. POST a FHIR `Bundle` of type `message` whose first entry is a MessageHeader with one of two events. `rtpbc-request-non-phi` asks for a medication's price without patient details: a Claim naming the product (an NDC of 11 digits with no dashes, or an RxNorm code) and the quantity, with the patient and the coverage masked, and a pharmacy, up to three ZIP codes, or both. It is answered by price sources: Cost Plus Drugs (its mail order and the Team Cuban Card) and ClixRx. `rtpbc-request` asks what a medication would cost a member under their coverage: the member's Patient and Coverage, with the payer's identifier in `payor.identifier`, the prescription and its prescriber, and a pharmacy. It is answered by the member's insurer, found by the payer's Payer ID: a `payor.identifier` whose `type` is `payerid` from `http://hl7.org/fhir/us/carin-bb/CodeSystem/C4BBIdentifierType`. An insurer that answers only with the member's own authorization is sent the access token from the member's login with that insurer, in the `Payer-Authorization` header, for that one request; it is never stored, logged or sent anywhere else. No insurer is connected yet. The answer is a `message` Bundle whose MessageHeader answers the request's, with one ClaimResponse that carries either prices and coverage in `item` or the reason there are none in `error`, and for a member's request the request's Patient as it was sent. With prices, `item` is the lowest price at a pharmacy near the ZIP codes or at the pharmacy named, every price is also an `addItem` alternative naming its pharmacy by an Organization in the Bundle and its price source in `programCode`, from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-price-source`, and `processNote` says where each price came from, when, and which free discount card pays it. Each price repeats the request's product coding, which CARIN requires to carry a display: an RxNorm code sent without one is answered with the display haau3's RxNorm release gives it, and an NDC needs its display sent with it. A check no connected source can answer carries `no-responder-for-coverage`, `no-price-source` or `source-not-available-to-caller` from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-processing-code`, and a member's request to an insurer that needs the member's authorization carries `payer-authorization-required` when none was sent and `payer-authorization-rejected` when the insurer refused it. A price is an estimate; the pharmacy confirms the price. A member's request receives patient data, so send it only under an executed agreement. Nothing a request carries is stored or logged, apart from the request's ids, and every answer is sent with `Cache-Control: no-store`. The operation takes no query parameters and is not offered inside a batch. The contract is published at https://fhir.haau3.com/pharmacy-benefits.html.
 
         `POST /v1/fhir/r4/$process-message`, https://docs.haau3.com/api-reference/pharmacy-benefits/check-what-a-medication-costs-pharmacy-benefit-check
+
+        Headers it declares, each a keyword of its own:
+
+        - `payer_authorization` (`Payer-Authorization`): A member's own authorization at their insurer, for a member's request (event `rtpbc-request`) to an insurer that answers only with it: `Bearer` and the access token your app obtained from the member's login with that insurer, as an `Authorization` header carries one. It is forwarded once, to that insurer, for this request, and is never stored, logged or sent anywhere else. Without it, such a request is answered `payer-authorization-required`; a token the insurer refuses is answered `payer-authorization-rejected`. A request without patient details that carries it is refused. Checked against the form the API takes for it, at most 4096 characters, before sending; a value it does not take is refused without being repeated, and the keyword wins over a `Payer-Authorization` in `extra_headers`. Held from the moment the call takes it where nothing prints it.
         """
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return self._engine.call(
-            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
         ).data
 
     def read_endpoint(
@@ -1951,6 +1958,7 @@ async def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -1961,12 +1969,18 @@ async def process_message(
         FHIR system-level operation `$process-message`, as the CARIN Consumer Real-Time Pharmacy Benefit Check (STU2 ballot, `2.0.0-ballot`) specifies. Not yet open to customers: while its price sources are being licensed, every request from a customer's organization, with or without patient details, is refused with `403` `forbidden`. POST a FHIR `Bundle` of type `message` whose first entry is a MessageHeader with one of two events. `rtpbc-request-non-phi` asks for a medication's price without patient details: a Claim naming the product (an NDC of 11 digits with no dashes, or an RxNorm code) and the quantity, with the patient and the coverage masked, and a pharmacy, up to three ZIP codes, or both. It is answered by price sources: Cost Plus Drugs (its mail order and the Team Cuban Card) and ClixRx. `rtpbc-request` asks what a medication would cost a member under their coverage: the member's Patient and Coverage, with the payer's identifier in `payor.identifier`, the prescription and its prescriber, and a pharmacy. It is answered by the member's insurer, found by the payer's Payer ID: a `payor.identifier` whose `type` is `payerid` from `http://hl7.org/fhir/us/carin-bb/CodeSystem/C4BBIdentifierType`. An insurer that answers only with the member's own authorization is sent the access token from the member's login with that insurer, in the `Payer-Authorization` header, for that one request; it is never stored, logged or sent anywhere else. No insurer is connected yet. The answer is a `message` Bundle whose MessageHeader answers the request's, with one ClaimResponse that carries either prices and coverage in `item` or the reason there are none in `error`, and for a member's request the request's Patient as it was sent. With prices, `item` is the lowest price at a pharmacy near the ZIP codes or at the pharmacy named, every price is also an `addItem` alternative naming its pharmacy by an Organization in the Bundle and its price source in `programCode`, from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-price-source`, and `processNote` says where each price came from, when, and which free discount card pays it. Each price repeats the request's product coding, which CARIN requires to carry a display: an RxNorm code sent without one is answered with the display haau3's RxNorm release gives it, and an NDC needs its display sent with it. A check no connected source can answer carries `no-responder-for-coverage`, `no-price-source` or `source-not-available-to-caller` from `https://haau3.com/fhir/CodeSystem/pharmacy-benefits-processing-code`, and a member's request to an insurer that needs the member's authorization carries `payer-authorization-required` when none was sent and `payer-authorization-rejected` when the insurer refused it. A price is an estimate; the pharmacy confirms the price. A member's request receives patient data, so send it only under an executed agreement. Nothing a request carries is stored or logged, apart from the request's ids, and every answer is sent with `Cache-Control: no-store`. The operation takes no query parameters and is not offered inside a batch. The contract is published at https://fhir.haau3.com/pharmacy-benefits.html.
 
         `POST /v1/fhir/r4/$process-message`, https://docs.haau3.com/api-reference/pharmacy-benefits/check-what-a-medication-costs-pharmacy-benefit-check
+
+        Headers it declares, each a keyword of its own:
+
+        - `payer_authorization` (`Payer-Authorization`): A member's own authorization at their insurer, for a member's request (event `rtpbc-request`) to an insurer that answers only with it: `Bearer` and the access token your app obtained from the member's login with that insurer, as an `Authorization` header carries one. It is forwarded once, to that insurer, for this request, and is never stored, logged or sent anywhere else. Without it, such a request is answered `payer-authorization-required`; a token the insurer refuses is answered `payer-authorization-rejected`. A request without patient details that carries it is refused. Checked against the form the API takes for it, at most 4096 characters, before sending; a value it does not take is refused without being repeated, and the keyword wins over a `Payer-Authorization` in `extra_headers`. Held from the moment the call takes it where nothing prints it.
         """
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return (
             await self._engine.call(
-                PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+                PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
             )
         ).data
 
@@ -3460,6 +3474,7 @@ def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -3468,8 +3483,10 @@ def process_message(
         """`Haau3.process_message`, returning a `Response` with the request id and timing as well as the answer."""
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return self._engine.call(
-            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
         )
 
     def read_endpoint(
@@ -4544,6 +4561,7 @@ async def process_message(
         body: fhir.Bundle,
         /,
         *,
+        payer_authorization: str | None = None,
         timeout: float | None = None,
         max_retries: int | None = None,
         correlation_id: str | None = None,
@@ -4552,8 +4570,10 @@ async def process_message(
         """`AsyncHaau3.process_message`, returning a `Response` with the request id and timing as well as the answer."""
         hidden: Hidden[object] = Hidden(body)
         del body
+        declared = HeldHeaders({"payer_authorization": payer_authorization})
+        del payer_authorization
         return await self._engine.call(
-            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers)
+            PROCESS_MESSAGE, (), (), hidden, Options(timeout, max_retries, correlation_id, extra_headers, declared)
         )
 
     async def read_endpoint(
diff --git a/src/haau3/_operation.py b/src/haau3/_operation.py
index 9d1ab3c..51f4aa4 100644
--- a/src/haau3/_operation.py
+++ b/src/haau3/_operation.py
@@ -8,6 +8,20 @@
 T = TypeVar("T")
 
 
+@final
+@dataclass(frozen=True)
+class DeclaredHeader:
+    """A header parameter an operation declares, sent from the call's keyword of its name in snake_case."""
+
+    wire: str
+    """The header, as the spec names it: `Payer-Authorization`."""
+    option: str
+    """The keyword it is sent from: `payer_authorization`."""
+    max_length: int | None = None
+    pattern: str | None = None
+    """The spec's pattern, an ECMAScript regular expression the generator checked Python reads alike."""
+
+
 @final
 @dataclass(frozen=True)
 class Operation(Generic[T]):
@@ -21,6 +35,8 @@ class Operation(Generic[T]):
     """The path in the spec, such as `/v1/fhir/r4/InsurancePlan/{id}`."""
     expects: tuple[str, ...] = ()
     """The FHIR resource types a success may be. Empty checks no type (Scheduling's answers)."""
+    headers: tuple[DeclaredHeader, ...] = ()
+    """The header parameters it declares, each sent from a keyword of the call's own."""
 
     @property
     def label(self) -> str:
diff --git a/src/haau3/_operations.py b/src/haau3/_operations.py
index af0a529..6e06a88 100644
--- a/src/haau3/_operations.py
+++ b/src/haau3/_operations.py
@@ -18,7 +18,7 @@
     SearchProviderLocationsResponse,
     SearchSlotsResponse,
 )
-from ._operation import Operation
+from ._operation import DeclaredHeader, Operation
 
 SPEC_VERSION: Final[str] = "1.0.0-preview.12"
 """The version of the API's spec this SDK was generated from."""
@@ -53,7 +53,16 @@
 LIST_PUBLISHERS: Final[Operation[ListPublishersResponse]] = Operation("GET", "/v1/scheduling/publishers", ())
 LIST_SERVICE_TYPES: Final[Operation[ListServiceTypesResponse]] = Operation("GET", "/v1/scheduling/service-types", ())
 LIST_SPECIALTIES: Final[Operation[ListSpecialtiesResponse]] = Operation("GET", "/v1/scheduling/specialties", ())
-PROCESS_MESSAGE: Final[Operation[fhir.Bundle]] = Operation("POST", "/v1/fhir/r4/$process-message", ("Bundle",))
+PROCESS_MESSAGE: Final[Operation[fhir.Bundle]] = Operation(
+    "POST",
+    "/v1/fhir/r4/$process-message",
+    ("Bundle",),
+    headers=(
+        DeclaredHeader(
+            "Payer-Authorization", "payer_authorization", 4096, "^[Bb][Ee][Aa][Rr][Ee][Rr] +[A-Za-z0-9\\-._~+/]+=*$"
+        ),
+    ),
+)
 READ_ENDPOINT: Final[Operation[fhir.Endpoint]] = Operation("GET", "/v1/fhir/r4/Endpoint/{id}", ("Endpoint",))
 READ_HEALTHCARE_SERVICE: Final[Operation[fhir.HealthcareService]] = Operation(
     "GET", "/v1/fhir/r4/HealthcareService/{id}", ("HealthcareService",)
diff --git a/src/haau3/_response.py b/src/haau3/_response.py
index d1c4a3d..ef38814 100644
--- a/src/haau3/_response.py
+++ b/src/haau3/_response.py
@@ -8,6 +8,8 @@
 
 import httpx2
 
+from ._body import HeldHeaders
+
 T_co = TypeVar("T_co", covariant=True)
 
 
@@ -59,3 +61,5 @@ class Options:
     max_retries: int | None = None
     correlation_id: str | None = None
     extra_headers: Mapping[str, str] | None = field(default=None, repr=False)
+    declared: HeldHeaders | None = field(default=None, repr=False)
+    """The keywords of the headers the operation declares, held where nothing prints them."""
diff --git a/src/haau3/_transport.py b/src/haau3/_transport.py
index 2fe8a06..cfa6d3d 100644
--- a/src/haau3/_transport.py
+++ b/src/haau3/_transport.py
@@ -7,6 +7,7 @@
 
 from __future__ import annotations
 
+import re
 import sys
 import time
 from collections.abc import Iterable, Sequence
@@ -17,11 +18,11 @@
 import httpx2
 
 from ._batch import BatchResult, batch_bundle, read_batch
-from ._body import Hidden, Secret
+from ._body import HeldHeaders, Hidden, Secret
 from ._encode import FHIR_BASE, QueryValue, encode_query, fill_path, is_fhir, is_uuid, json_bytes, path_of, url_on_base
 from ._errors import Haau3Error, NoAnswerError, NoAnswerReason
 from ._judge import Context, detail, judge, parse_body, retry_after_seconds, wait_after_answer, wait_after_failure
-from ._operation import Operation
+from ._operation import DeclaredHeader, Operation
 from ._response import Options, RawResponse, Response
 from ._version import __version__
 
@@ -148,8 +149,50 @@ class _AttemptTimedOut(Exception):
     """A sync attempt's body was still arriving at its deadline."""
 
 
+def _problem(header: DeclaredHeader, declared: HeldHeaders) -> str | None:
+    """What is wrong with one declared header's value, in words that never carry it; None when it may go.
+
+    Its own frame, so the value is gone before anything is raised: a traceback that shows each frame's
+    local variables shows `declared`, which prints as `<headers hidden>`, and nothing else.
+    """
+    value = declared.reveal().get(header.option)
+    if value is None:
+        return None
+    if header.max_length is not None and len(value) > header.max_length:
+        return f"is longer than the {header.max_length} characters the API takes in {header.wire}."
+    # A header value never holds a line break, and Python's `$` would match before a final one.
+    if "\n" in value or "\r" in value or (header.pattern is not None and re.search(header.pattern, value) is None):
+        return f"is not in the form the API takes in {header.wire}, which the keyword's description gives."
+    return None
+
+
+def declared_headers(operation: Operation[Any], options: Options) -> HeldHeaders | None:
+    """The headers `operation` declares, from the call's own keywords, by header name and lower-cased.
+
+    Each value set is checked against the spec's schema for it, and one the API would refuse is refused
+    here, before anything is sent, in a message that names the keyword, never the value: a header such
+    as `Payer-Authorization` carries a credential.
+    """
+    if options.declared is None or not operation.headers:
+        return None
+    for header in operation.headers:
+        problem = _problem(header, options.declared)
+        if problem is not None:
+            raise Haau3Error(f"{operation.label} was not sent: {header.option} {problem}")
+    values = options.declared.reveal()
+    return HeldHeaders(
+        {h.wire.lower(): values[h.option] for h in operation.headers if values.get(h.option) is not None}
+    )
+
+
 def prepare(
-    config: Config, method: Method, url: str, content: Hidden[bytes] | None, options: Options, name: str
+    config: Config,
+    method: Method,
+    url: str,
+    content: Hidden[bytes] | None,
+    options: Options,
+    name: str,
+    declared: HeldHeaders | None = None,
 ) -> Prepared:
     """Headers and limits for a request. A `correlation_id` that is not a UUID is refused before the key is touched."""
     if options.correlation_id is not None and not is_uuid(options.correlation_id):
@@ -168,6 +211,10 @@ def prepare(
         headers["content-type"] = FHIR_JSON if fhir else "application/json"
     for header, value in (options.extra_headers or {}).items():
         headers[header.lower()] = value
+    # A header the operation declares is sent from its own keyword, over the same one in extra_headers.
+    for wire, held in (declared.reveal() if declared is not None else {}).items():
+        if held is not None:
+            headers[wire] = held
     if options.correlation_id is not None:
         headers["x-request-id"] = options.correlation_id
     return Prepared(
@@ -287,7 +334,8 @@ def call(
         options: Options,
     ) -> Response[T]:
         url = self.operation_url(operation, path_values, query)
-        sent = self.send(operation.method, url, body_bytes(body), options, operation.label)
+        declared = declared_headers(operation, options)
+        sent = self.send(operation.method, url, body_bytes(body), options, operation.label, declared)
         return sent.response(cast("T", answer_of(operation.label, operation.expects, sent).reveal()))
 
     def batch(self, calls: Sequence[object], options: Options) -> Response[tuple[BatchResult[Any], ...]]:
@@ -306,8 +354,16 @@ def request(
         url = self.resolve(path, query)
         return raw_response(self.send(method, url, raw_content(body), options, self.name(method, url)))
 
-    def send(self, method: Method, url: str, content: Hidden[bytes] | None, options: Options, name: str) -> Sent:
-        prepared = prepare(self._config, method, url, content, options, name)
+    def send(
+        self,
+        method: Method,
+        url: str,
+        content: Hidden[bytes] | None,
+        options: Options,
+        name: str,
+        declared: HeldHeaders | None = None,
+    ) -> Sent:
+        prepared = prepare(self._config, method, url, content, options, name, declared)
         started = time.monotonic()
         attempt = 0
         while True:
@@ -385,7 +441,8 @@ async def call(
         options: Options,
     ) -> Response[T]:
         url = self.operation_url(operation, path_values, query)
-        sent = await self.send(operation.method, url, body_bytes(body), options, operation.label)
+        declared = declared_headers(operation, options)
+        sent = await self.send(operation.method, url, body_bytes(body), options, operation.label, declared)
         return sent.response(cast("T", answer_of(operation.label, operation.expects, sent).reveal()))
 
     async def batch(self, calls: Sequence[object], options: Options) -> Response[tuple[BatchResult[Any], ...]]:
@@ -404,8 +461,16 @@ async def request(
         url = self.resolve(path, query)
         return raw_response(await self.send(method, url, raw_content(body), options, self.name(method, url)))
 
-    async def send(self, method: Method, url: str, content: Hidden[bytes] | None, options: Options, name: str) -> Sent:
-        prepared = prepare(self._config, method, url, content, options, name)
+    async def send(
+        self,
+        method: Method,
+        url: str,
+        content: Hidden[bytes] | None,
+        options: Options,
+        name: str,
+        declared: HeldHeaders | None = None,
+    ) -> Sent:
+        prepared = prepare(self._config, method, url, content, options, name, declared)
         started = time.monotonic()
         attempt = 0
         while True:

From 737ca933af5c127f1406bafad95897f4c7362f1a Mon Sep 17 00:00:00 2001
From: Brian K Fung <64922294+briankfung@users.noreply.github.com>
Date: Fri, 23 Oct 2026 00:27:48 -0400
Subject: [PATCH 2/2] test: process_message's payer_authorization, sent,
 checked and held where nothing prints it

Each test runs sync, on asyncio and on trio. The header is sent beside the key's own
Authorization, and not sent when unset (the control). Any case of the scheme is taken. A bare
token, another scheme, an empty value, a final line break and 4,097 characters are each refused
before anything is sent, with the value nowhere in the error or in the SDK's frames printed with
their local variables; 4,096 characters are taken. The keyword wins over the same header in
extra_headers, is sent again on a retry, and is carried by no error the API answers. The holder
never prints or pickles what it holds, and only process_message takes the keyword. A positive
control checks that the SDK's frames are printed with their locals.

The generator's tests: an optional header becomes a keyword of the operation's own, and the
generator stops on a required header, a cookie, a name that clashes with a call option or a query
parameter, a schema that is not a string, a pattern Python cannot read, and a header on an
operation a batch can carry. The README test gives the new block its access token.

Negative controls, each failing its tests and restored with cp: the keyword's name kept in the
method's frame (5 fail), the pattern unchecked (9), extra_headers winning (3), the refusal raised in
the frame that holds the value (9).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/test_generate.py       |  37 +++++++++
 tests/test_header_options.py | 144 +++++++++++++++++++++++++++++++++++
 tests/test_readme.py         |   1 +
 3 files changed, 182 insertions(+)
 create mode 100644 tests/test_header_options.py

diff --git a/tests/test_generate.py b/tests/test_generate.py
index f5a0c2e..6d8494b 100644
--- a/tests/test_generate.py
+++ b/tests/test_generate.py
@@ -154,6 +154,43 @@ def test_the_generator_refuses_a_parameter_it_cannot_name_or_type(parameters: li
         generate.Spec(_mini(parameters))
 
 
+def _header(**changes: object) -> dict[str, object]:
+    return {"name": "X-Example-Option", "in": "header", "schema": {"type": "string"}, **changes}
+
+
+def test_an_optional_header_is_a_keyword_of_the_operations_own() -> None:
+    op = next(
+        o
+        for o in generate.Spec(_mini([_header(schema={"type": "string", "maxLength": 9})])).ops
+        if o.id == "listPublishers"
+    )
+    assert [(h.wire, h.python, h.max_length) for h in op.headers] == [("X-Example-Option", "x_example_option", 9)]
+
+
+@pytest.mark.parametrize(
+    ("parameters", "words"),
+    [
+        ([_header(required=True)], "required header"),
+        ([{"name": "session", "in": "cookie", "schema": {"type": "string"}}], "in cookie"),
+        ([_header(name="Timeout")], "clash"),
+        ([_header(name="Name"), {"name": "name", "in": "query", "schema": {"type": "string"}}], "clash"),
+        ([_header(schema={"type": "integer"})], "not a string"),
+        ([_header(schema={"type": "string", "pattern": "(unclosed"})], "missing"),
+    ],
+    ids=["required", "a cookie", "an option's name", "a query parameter's name", "not a string", "a bad pattern"],
+)
+def test_the_generator_stops_on_a_header_it_cannot_send(parameters: list[dict[str, object]], words: str) -> None:
+    with pytest.raises(Exception, match=words):
+        generate.Spec(_mini(parameters))
+
+
+def test_a_header_on_an_operation_a_batch_can_carry_stops_the_generator() -> None:
+    spec: dict[str, Any] = json.loads(json.dumps(SPEC))
+    spec["paths"]["/v1/fhir/r4/metadata"]["get"].setdefault("parameters", []).append(_header())
+    with pytest.raises(ValueError, match="whose entries carry no headers"):
+        generate.Spec(spec)
+
+
 def test_the_generator_refuses_a_spec_without_the_batch() -> None:
     spec = json.loads(json.dumps(SPEC))
     del spec["paths"]["/v1/fhir/r4"]
diff --git a/tests/test_header_options.py b/tests/test_header_options.py
new file mode 100644
index 0000000..327845e
--- /dev/null
+++ b/tests/test_header_options.py
@@ -0,0 +1,144 @@
+"""A header an operation declares is a keyword of the call's own: process_message's payer_authorization.
+
+It is sent as Payer-Authorization, checked against the spec's schema before anything is sent, wins
+over the same header in extra_headers, and is held where nothing prints it, a traceback's local
+variables included.
+"""
+
+from __future__ import annotations
+
+import pickle
+import traceback
+from typing import Any
+
+import pytest
+
+from haau3 import Haau3Error, RefusedError
+from haau3._body import HeldHeaders
+
+from .helpers import Client, Recorder, answer
+
+MESSAGE: dict[str, Any] = {"resourceType": "Bundle", "type": "message", "entry": []}
+ANSWER = {"resourceType": "Bundle", "type": "message", "entry": []}
+# A token no error, message or printout may ever carry.
+TOKEN = "eyJ0b2tlbi10aGF0LW11c3QtbmV2ZXItYmUtcHJpbnRlZA"
+
+
+def printed(error: BaseException) -> str:
+    """The error as anything would print it, with the local variables of every frame of the SDK's own.
+
+    The caller's frames are left out: a value the caller holds in a variable of its own is the caller's
+    to keep out of a log, and the test's helpers hold the keyword in theirs.
+    """
+    tb = error.__traceback__
+    while tb is not None and "/src/haau3/" not in tb.tb_frame.f_code.co_filename:
+        tb = tb.tb_next
+    assert tb is not None, "the error was raised in no frame of the SDK's"
+    sdk = traceback.TracebackException(type(error), error, tb, capture_locals=True)
+    return "\n".join(["".join(sdk.format()), repr(error), str(error), repr(vars(error))])
+
+
+@pytest.mark.anyio
+async def test_it_is_sent_as_payer_authorization_beside_the_key(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=f"Bearer {TOKEN}")
+    assert recorder.last.headers["payer-authorization"] == f"Bearer {TOKEN}"
+    assert recorder.last.headers["authorization"].startswith("Bearer haau3_sk_")
+
+
+@pytest.mark.anyio
+async def test_nothing_is_sent_when_it_is_not_given(kind: str) -> None:
+    # The control: the header is the keyword's doing.
+    recorder = Recorder(answer(200, ANSWER))
+    client = Client(kind, recorder)
+    await client("process_message", MESSAGE)
+    await client("process_message", MESSAGE, timeout=5)
+    assert len(recorder.requests) == 2
+    assert all("payer-authorization" not in r.headers for r in recorder.requests)
+
+
+@pytest.mark.anyio
+async def test_any_case_of_the_scheme_is_taken_as_the_api_takes_it(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=f"bearer  {TOKEN}")
+    assert recorder.last.headers["payer-authorization"] == f"bearer  {TOKEN}"
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    ("value", "words"),
+    [
+        (TOKEN, "is not in the form the API takes in Payer-Authorization"),
+        (f"Basic {TOKEN}", "is not in the form the API takes in Payer-Authorization"),
+        ("", "is not in the form the API takes in Payer-Authorization"),
+        (f"Bearer {TOKEN}\n", "is not in the form the API takes in Payer-Authorization"),
+        ("Bearer " + "a" * 4090, "is longer than the 4096 characters the API takes in Payer-Authorization"),
+    ],
+    ids=["a bare token", "another scheme", "an empty value", "a final line break", "4,097 characters"],
+)
+async def test_a_value_the_api_would_refuse_is_refused_before_sending(kind: str, value: str, words: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    error = await Client(kind, recorder).raises("process_message", MESSAGE, payer_authorization=value)
+    assert isinstance(error, Haau3Error)
+    assert recorder.requests == []
+    assert str(error).startswith(f"POST /v1/fhir/r4/$process-message was not sent: payer_authorization {words}")
+    if value:
+        assert value.strip()[-20:] not in printed(error)
+    assert TOKEN not in printed(error)
+    # The control: the SDK's frames are printed with their locals, the held keyword among them.
+    assert "declared = <headers hidden>" in printed(error)
+
+
+@pytest.mark.anyio
+async def test_4096_characters_the_apis_own_limit_are_taken(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    at_limit = "Bearer " + "a" * 4089
+    assert len(at_limit) == 4096
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=at_limit)
+    assert recorder.last.headers["payer-authorization"] == at_limit
+
+
+@pytest.mark.anyio
+async def test_it_wins_over_the_same_header_in_extra_headers(kind: str) -> None:
+    recorder = Recorder(answer(200, ANSWER))
+    await Client(kind, recorder)(
+        "process_message",
+        MESSAGE,
+        payer_authorization=f"Bearer {TOKEN}",
+        extra_headers={"PAYER-AUTHORIZATION": "Bearer from-extra-headers"},
+    )
+    assert recorder.last.headers.get_list("payer-authorization") == [f"Bearer {TOKEN}"]
+
+
+@pytest.mark.anyio
+async def test_it_is_sent_again_on_a_retry(kind: str) -> None:
+    recorder = Recorder(answer(503, None), answer(200, ANSWER))
+    await Client(kind, recorder)("process_message", MESSAGE, payer_authorization=f"Bearer {TOKEN}", max_retries=1)
+    assert [r.headers["payer-authorization"] for r in recorder.requests] == [f"Bearer {TOKEN}"] * 2
+
+
+@pytest.mark.anyio
+async def test_no_error_the_api_answers_carries_it_however_it_is_printed(kind: str) -> None:
+    outcome = {"resourceType": "OperationOutcome", "issue": [{"severity": "error", "code": "invalid"}]}
+    recorder = Recorder(answer(400, outcome))
+    error = await Client(kind, recorder).raises("process_message", MESSAGE, payer_authorization=f"Bearer {TOKEN}")
+    assert isinstance(error, RefusedError)
+    assert TOKEN not in printed(error)
+    assert "declared = <headers hidden>" in printed(error)
+
+
+def test_the_holder_never_prints_or_pickles_what_it_holds() -> None:
+    held = HeldHeaders({"payer_authorization": f"Bearer {TOKEN}"})
+    for text in (repr(held), str(held), f"{held}", f"{held!r:>40}"):
+        assert TOKEN not in text
+        assert "<headers hidden>" in text
+    with pytest.raises(TypeError):
+        pickle.dumps(held)
+
+
+@pytest.mark.anyio
+async def test_only_the_operation_that_declares_it_takes_the_keyword(kind: str) -> None:
+    recorder = Recorder(answer(200, {"resourceType": "InsurancePlan", "id": "H1"}))
+    with pytest.raises(TypeError):
+        await Client(kind, recorder)("read_insurance_plan", "H1", payer_authorization=f"Bearer {TOKEN}")
+    assert recorder.requests == []
diff --git a/tests/test_readme.py b/tests/test_readme.py
index 0cbef25..1eeecbd 100644
--- a/tests/test_readme.py
+++ b/tests/test_readme.py
@@ -45,6 +45,7 @@ def _arguments() -> dict[str, Any]:
         "message": message,
         "codes": ["2345-7", "2160-0"],
         "job_id": str(uuid.uuid4()),
+        "access_token": "eyJhbGciOiJub25lIn0.e30.example",
     }