Sent as Authorization: Bearer … only to the hosts of layers that have “Send bearer token” enabled — never to the Carto basemap. The tile server must allow the Authorization header via CORS.