By default, API Security detects and extracts authentication and authorization items that are located in the Authorization request header. The Bearer and Basic supported methods are Bearer and Basic.
API Security also allows for configuration-driven authorization and authentication extraction, meaning that you can specify custom locations to find and extract authentication and authorization items. The /v2/trace-analysis/authConfigurations endpoint returns the list of such custom authentication extraction configurations.