private String getRawAuthToken(ApiRequest request) {
        String rawToken = StringUtils.strip(request.getHeaders().get(AUTHORIZATION_KEY));

        if (rawToken != null && StringUtils.startsWithIgnoreCase(rawToken, BEARER)) {
            rawToken = StringUtils.removeStartIgnoreCase(rawToken, BEARER);
        } else {
            rawToken = request.getQueryParams().get(ACCESS_TOKEN_QUERY_KEY);
        }

        return rawToken;
    }
@see io.apiman.gateway.engine.policies.AbstractMappedPolicy#doApply(io.apiman.gateway.engine.beans.ApiRequest,
     io.apiman.gateway.engine.policy.IPolicyContext, java.lang.Object,
     io.apiman.gateway.engine.policy.IPolicyChain)
plugins/keycloak-oauth-policy/src/main/java/io/apiman/plugins/keycloak_oauth_policy/KeycloakOauthPolicy.java