Authorization
Demo token
demo-token-123
Real apps should issue per-user tokens via your identity provider and never hard-code shared secrets.