BrowserStack Local tunnel authentication for protected endpoints

BrowserStack Local allows cloud-based tests to access secure local networks by routing traffic through a secure tunnel. When the local capability is enabled, the infrastructure connects to the local environment to access internal endpoints or localhost.

A challenge arises when the target local environment requires specific authentication mechanisms, such as custom headers or basic authentication, to grant access to the application under test. While the tunnel establishes the network path, the interaction between the BrowserStack cloud agent and the local security layer must be explicitly managed to avoid 401 or 403 errors.

What is the recommended configuration for passing custom authentication headers through the BrowserStack Local tunnel to a protected internal endpoint? Does the platform support dynamic header injection at the tunnel level, or must these be handled entirely within the test script's request logic?