PyPI's credential presentation: the HTTP Basic pair a Python client sends on Authorization, recovered here and attached under the same scheme going upstream.

The username is a client-side convention rather than an identity the index checks, so the recovery admits any username and the edge gate compares the password half alone. A credential Écluse holds rather than receives carries no username and travels under token, the name PyPI's own tooling writes for a token. A pair a client sent travels verbatim, because rewriting a username would authenticate as somebody else.