probably just use "basic auth" form: curl 'http://dapr-app-id:checkout@localhost:3602/checkout/100' -X POST as injecting headers in tracking store pointing at replay server will be annoying https://docs.dapr.io/developing-applications/building-blocks/service-invocation/service-invocation-overview/