and the auth header should contain both keys, not ...
# suitetalkapi
a
and the auth header should contain both keys, not hashed