Authentication via iPXE when using boot, chain, kernel, initrd etc.

[obie]

My question is around authentication when using boot, chain, kernel, initrd etc. My use case is if I have an url that returns a boot image that needs an API key header or an OAuth token.

http://ipxe.org/cmd/kernel - From what I understand here, I can pass a timeout, a name, and other arguments that go straight to the image. How do I pass authentication headers?

Additionally, I have a question about best practices regarding secrets as well. What's the alternative to keeping them in the ipxe script in plaintext? I'm actually fine with that but would be useful to know best practices.