Unity Addressables remote catalog loading lacks a first-class authentication hook

Unity Addressables loads remote catalogs and AssetBundles over HTTP through LoadContentCatalogAsync and LoadAssetAsync, but the public API does not expose a per-request callback for injecting authentication headers. When a protected endpoint returns HTTP 401 or 403 because a credential expired, the failure surfaces as a generic catalog or bundle download error rather than a re-authentication event. The catalog hash mechanism validates content integrity, not authorization, so an expired token blocks access without a built-in refresh or retry-with-new-token flow.

Common workarounds include unauthenticated CDNs, pre-signed URLs with long TTLs, or overriding internal IResourceProvider implementations in the ResourceManager. These internal provider interfaces are not covered by the public API stability guarantees and can change between Addressables package releases. This creates a permission boundary where Unity cannot natively satisfy least-privilege authentication for remote content.

Is there a documented configuration point or supported extension in current Addressables versions to attach authentication headers to remote catalog and bundle requests? If not, what is the least brittle approach to distinguish an expired credential from a genuine network failure without relying on internal provider overrides? How should a project structure a re-authentication and retry flow when the public API surfaces only a generic download error?