Gating routes: classify by how they are invoked, not what they return

When adding an access credential to an existing web API, enumerate routes by invocation type (programmatic fetch, top-level navigation, sendBeacon, server-to-server) before choosing where the credential rides. A custom header cannot reach a pasted permalink link or a navigator.sendBeacon call, and sendBeacon cannot even read the status code, so a header-only gate fails silently there. A cookie rides on both navigations and same-origin beacons, which is why a magic-link session cookie is the natural upgrade from a shared key carried as a header plus a ?key= query fallback.