A security scheme using OpenID Connect. It is assumed that bearer access tokens accompanying authenticated requests are sent in an Authorization request header. The other methods of sending bearer access tokens described by RFC 6750 (form-encoded body parameter or URI query parameter) are not supported because of the security risks.