How do I make authenticated HTTP requests to a custom API?

I’ve got a custom API I need to hit from a workflow, and it requires authentication on every call. How do I set up an authenticated HTTP request in 3B? I’m curious where the token or key lives, how I attach it to each request, and how to keep it out of plain sight. A walkthrough of the recommended setup would be really helpful.