npm's credential presentation: the Bearer token an npm client sends on Authorization, recovered at the edge and attached under the same scheme upstream.

The npm CLI turns an .npmrc //host/:_authToken=... entry into that one header, so a mount serving npm accepts and presents that form alone. One CredentialMapping declares both directions, so the recovered token and the header it travels on cannot drift apart.