Global API defaults can silently leak auth headers across services. Here’s how isolated client configs prevent that risk.