pub const DUMMY_CREDENTIAL: &str = "forge-gateway-unused";
What the CLI sends when it has no real credential. Authorises nothing upstream; the gateway replaces it before forwarding.