Any header/token-based credential this login plugin wants a downstream metadata/download call to send (e.g. { "Authorization": "Key <api_key>" }, a bearer token, a custom signed-request header — whatever the target site's own auth scheme needs). Independent of cookies and of LegacyUserAgent entirely: a plugin using legacyCompat.userAgent() can hand back its own ua.headers snapshot here (see that property's own docs), but nothing requires going through userAgent() at all — a plugin that authenticates with a plain fetch() call and holds the resulting token in a local variable can just return { headers: { Authorization: Bearer ${token} } } directly. For a site authenticating via a header/token rather than a cookie, this is the only way that credential actually reaches a downstream call; cookies alone is empty for such a login plugin (issue #78/#93: nhapiauth's Authorization header used to have no way to cross this boundary at all before this field existed).