The Stream Deck just embeds Chromium to run it’s JavaScript plugins. The latest V6 update of the software updated the Chromium engine, which also broke a lot of other plugins due to CORS policy changes (including my button for Bunpro), which they fixed that at least. Chrome/JS doesn’t let you access the cookies in the request headers directly to prevent cross-site attacks, but I did initially try to go down the path of reading the set-cookie value and just set the header myself.
Again, no rush, I still haven’t received a response from Elgato but with the holidays I wouldn’t be surprised if they don’t respond until next week, but I’m hoping it’s something they can fix rather than needing you to do anything. If you did go down the Authorization path though, I’d be good with any implementation, including bearer tokens or just a simple basic auth implemenation.