I went through this debate recently also and also ended up realizing there was no clear cut winner, but we did end up coming down on the same method of using he

I went through this debate recently also and also ended up realizing there was no clear cut winner, but we did end up coming down on the same method of using headers. But oddly I get anxiety when I see other APIs that have gone for a different choice! Also considered that maybe could do all 3, or header || query parameter (which we may still do).