Cross-posting this from #207:
#207 (comment)

@philvarner I added a pathway to pass headers to pystac.Client.open on a fork of this repo. It's not feature complete but works if you have an API Headers authentication configuration set up in QGIS.

@hrodmn so the workflow for your users would be something like this:

1. In Web browser: log in your website > copy the token
2. In QGIS: STAC Plugin > Select provider > Add/edit Header Auth (APIHeader) > Add/edit key and values, e.g. key=Authorization, value=Bearer xxxxxxxx for instance
3. Use the secured STAC endpoint

Is that correct?

@remicres yes that is how I tested it. It is not a very intuitive workflow, but if you know which key/value pairs you need for API Header authentication it works fine. If we ever merge this change into the main branch it will be important to add some more documentation in the connection widget to guide users down this path!

@hrodmn this looks nice. I agree that this PR points in the right direction.

In my case, also should transform COG assets URLs (and vectors also).
Indeed my COG server needs some Authorization: Bearer xxxx...Xxx in the header.
Then GDAL can pass the key/value using this trick:

url = "https://myserver.com/path/to/image.tif
new_url = f"/vsicurl?header_file={headers_file}&url={url}"

With headers_file containing one key/value per line

Authorization: Bearer xxxx...Xxx
...

So I "just" have to grab the the key/value pairs from QGIS, save them in a temporary file, and transform the assets URLs.