in AEMaaCS ;
https://experienceleague.adobe.com/en/docs/experience-manager-learn/getting-started-with-aem-headless/authentication/service-credentials#create-a-technical-account
maybe simply assume that when providing basic credentials in url user:password@host then when user is bearer then password is a token ; then aemc just will send different header (or sth like that)