How to authenticate calls from a Zoho Desk Extension using a custom API key?

I am trying to integrate my app with Zoho Desk by creating a Zoho Desk Extension.

I want all the calls generated by the extension to also send an API key, so that I can verify it on my server to make sure it is Zoho making the calls.

And it is my understanding that I can setup a custom "Connection" in Zoho Sigma that will include a custom API key in the header of any calls made by the extension.

The problem is that none of the calls made by the extension include the custom API key in the header.

This is how I am creating the Connection for the extension:

1. Inside Zoho Sigma, click Connections tab > Custom Services > Create Service. Here are the settings I used when creating the service:

• "Service Name" = "MyApp"
• "Service Link Name" = "myapp"
• "Authentication Type" = "Header"
• "Parameter Key" = "api"
• "Parameter Display Name" = "api"

2. Click "Create Connection" for the service just created. Here are the settings I used when creating the connection:

• "Connection Name" = "MyApp"
• "Connection Link Name" = "myapp"
• "Use Credentials of Login User" = "Yes"

3. Click "Connect" for the connection just created. Then input the Api key value (for example "123test").
4. Copy the "Sample Code" on the "JSON" tab for the connection just created, and paste that into the connectors array of the extensions plugin-manifest.json file.
5. Run zet pack to pack the extension, and then upload to Zoho Sigma.
6. Install the extension into Zoho Desk by following the Install URL link.
7. Authorize the connection again when it asks (for example "123test"). I have no idea why it asks for this again, but I did it anyway just in case.

At the end of this process I assumed all the calls sent to my sync push/pull endpoints defined in the extensions resources.json would have the api key in the header. But they do not, there isn't even an api header field for those calls.

I tested this by using hookbin.com and you can see details of those calls, and the missing api header field that I thought it would have: https://hookbin.com/6JqjpyMNyzToO0ro3nGQ

What am I doing wrong?

Here is the resources.json file of the extension:

{
    "channel": {
        "resourceName"        : "webApp",
        "channelLogoPath"     : "/app/img/logo.png",
        "acceptAttachments"   : false,
        "updateRecords"       : true,
        "contentTypes"        : ["text/plain","text/html"],
        "redirectUrl"         : "https://hookb.in/6JqjpyMNyzToO0ro3nGQ",
        "includeQuotedMessage": false,
        "sync": {
            "push": "https://hookb.in/6JqjpyMNyzToO0ro3nGQ",
            "pull": "https://hookb.in/6JqjpyMNyzToO0ro3nGQ"
        }
    }
}

Here is the plugin-manifest.json file of the extension:

{
  "locale": [
    "en"
  ],
  "service": "DESK",
  "storage": false,
  "type": "personal",
  "whiteListedDomains": [https://hookb.in"],
  "modules": {
    "widgets": [
      {
        "location": "desk.ticket.detail.rightpanel",
        "url": "/app/widget.html",
        "name": "Agent Cake Extension",
        "logo": "/app/img/logo.png",
        "icon": "/app/img/icon.png"
      }
    ]
  },
  "cspDomains": {
    "connect-src": []
  },
  "zohoAuthorisation": {},
  "callbackListener": {
    "onInstall": "https://hookb.in/6JqjpyMNyzToO0ro3nGQ",
    "onUpdate": "https://hookb.in/6JqjpyMNyzToO0ro3nGQ"
  },
  "connectors": [{
    "connectionLinkName": "myapp",
    "connectionName": "MyApp",
    "serviceName": "myapp",
    "userAccess": true,
    "isUserDefinedService": true,
    "sharedBy": "7002150130"
  }],
  "config": [],
  "moduleSupport": false,
  "secret": "somerandomstringhere"
}