# `Pixir.Provider.ResponsesAuth`
[🔗](https://github.com/Ranvier-Technologies/pixir/blob/main/lib/pixir/provider/responses_auth.ex#L1)

Resolves ephemeral request authentication for one Responses Provider attempt.

The opaque value owns only the already-resolved headers for that attempt. It is
deliberately unsuitable for persistence or diagnostics: `Inspect` and `summary/1`
expose the policy and ordered header names, never credential values. Backend/route
binding is delegated to `Pixir.Provider.ResponsesRouting` before any credential
source is read.

A caller should resolve a fresh value for each outer Provider attempt and reuse that
value for any transport fallback within the attempt. This keeps token rotation
request-scoped without allowing routing or backend policy to drift.

# `t`

```elixir
@opaque t()
```

Opaque, ephemeral authentication resolved for one Provider attempt.

# `headers`

```elixir
@spec headers(t()) :: [{String.t(), String.t()}]
```

Return the resolved lowercase request headers.

# `resolve`

```elixir
@spec resolve(Pixir.Providers.ResolvedProviderRequest.t(), term(), keyword()) ::
  {:ok, t()} | {:error, map()}
```

Resolve request-scoped auth after validating the frozen route/backend binding.

# `summary`

```elixir
@spec summary(term()) :: map() | :invalid
```

Return a total, redacted diagnostic projection.

---

*Consult [api-reference.md](api-reference.md) for complete listing*