Users should be able to customize the way the authorizer extracts API keys from the request using CloudFormation parameters. The following schemes seem useful, although certainly there are others:
authorization:bearer() - The current bearer token logic
authorization:bearer(plain) - Same as above
authorization:bearer(base64) - A base64-encoded bearer token
authorization:basic() - HTTP basic authentication, where the API key is the entire credential
authorization:basic(user) - HTTP basic authentication, where the API key is the user part
authorization:basic(password) - HTTP basic authentication, where the API key is the password part
header:$HEADER_NAME() - API key is stored in HTTP header $HEADER_NAME
These options should be given in a CommaDelimitedList parameter, with each element of the list being tried in turn in the order given. If no given approach to extracting an API key is successful, then unauthorized.