how to pass authorization header to api