Authentication and especially authorization can be completely handled by PostgreSQL. In front of it all sits OpenResty (nginx) so that is where you would add whatever headers you would need