I don’t remember, exactly. Long time ago (I stepped away from that project many years ago).

I just remember the auth headers never showing up in the $_SERVER global (it was a PHP app). This was what I was told was the issue. They made it sound like it was well-known.