How “just forward the request” turns into a surprisingly complicated job

You send a request:
Get /orders
Authorization: Bearer eyfghj…..