Function is_credential_header 

pub fn is_credential_header(name: &str) -> bool

Returns true when name is a header that carries a credential by definition, so a plain header with that name is refused (see HttpRequest::apply_options).

The exact list, ignoring case: authorization, proxy-authorization, x-api-key, api-key, x-goog-api-key, cookie, cf-aig-authorization, ocp-apim-subscription-key, x-amz-security-token. Send these as a Credential.

Redaction is broader: is_sensitive_header also matches names that merely contain key, token, secret or auth, which are redacted but not refused, so Idempotency-Key passes.

use allama_http::is_credential_header;

assert!(is_credential_header("Authorization"));
assert!(is_credential_header("cf-aig-authorization"));
assert!(!is_credential_header("Idempotency-Key"));