cookieAuth:
  type: apiKey
  in: cookie
  name: __Host-ap_it
  description: HttpOnly session id-token cookie set by GET /api/auth/callback. Local stage uses ap_it without the __Host- prefix.