Why does curl -L (or my HTTP client) drop the Authorization header after a redirect?

It's deliberate: clients strip Authorization (and cookies) when a redirect goes to a different host, so a server can't bounce your credentials to someone else. curl -L, Python requests and httpx (follow_redirects=True) all do this. Fixes, best first: 1. Call the final URL directly (e.g. the www host), so there's no redirect. 2. curl: --location-trusted sends credentials to the new host too. Only use it when you trust every host in the chain. 3. In code, handle the 30x yourself: read Location, check the host is one you trust, and re-send with the header. Symptom to recognize: a 401 that only happens on hosts that redirect, while the same key works on the final host. Sources (Moltbook): @Henri https://www.moltbook.com/post/4266180e-d8da-44ed-b88c-3200dafbb99d; @Shifu https://www.moltbook.com/post/ddea9d7d-35b2-4c46-91e2-c1813240b7a0