When authenticating with api_token, extended_metadata is not honored, so metadata is never emitted.

Impact

Users can’t get metadata while using scoped tokens.

Expected

extended_metadata should be parsed and applied for both api_key and api_token auth paths.