By default, authorization headers are stripped out by Apache and therefore do not reach the underlying CGI script. This causes problems when Koha is receiving API requests that contain them as the client just receives a 401 response, even if a valid token was provided. I propose we add the CGIPassAuth directive to the API Directory blocks.
Created attachment 130038 [details] [review] Bug 29992: Add CGIPassAuth directive
That's interesting, although why are you running the API as CGI and not as PSGI through Starman?
I still don't really understand this one and I don't think Andrew is coming back to work on it.