The CDN Backend API recognized authenticated requests in haproxy, based on the presence of valid JWTs in bearer tokens or session cookies. Centralauth places similar JWTs in two different places, to allow cross-site requests to be authenticated with one-time tokens. These tokens should also cause requests to be treated as authenticated.

Centralauth tokens can be provided in three ways:

• an Authorization header using the Centralauthtoken prefix (instead of the Bearer prefix used by OAuth)
• a centralauthtoken query parameter
• a centralauthtoken field in the (application/x-www-form-urlencoded or multipart/form-data) POST data