Clarifying the authentication & authorization of Receiver endpoints

[TusharR-google]

In the Transmitter section we have

SSF is an HTTP based signals sharing framework and is agnostic to the authentication and authorization schemes used to secure stream configuration APIs.

Note that it explicitly says "stream configuration APIs", which raises the question of the statement's applicability to other endpoints that are not related to stream configuration.

• Does it apply to the Transmitter's POLL endpoint?
• How about the Receiver's PUSH endpoint?
• For PUSH delivery we support authorization_header, does that mean that Receivers are not expected to put this endpoint behind OAuth or other custom Auth?
• Related: We should probably clarify the format of authorization_header - does it expect the value Authorization: XYZ, or just XYZ and the Transmitter will convert that to the full header.

In the PUSH RFC8935, it says

The SET delivery method described in this specification is based upon HTTP over TLS [RFC2818] and standard HTTP authentication and authorization schemes, as per [RFC7235].

Does this mean that headers like X-goog-api-key: API_KEY are unsupported?