The general expectation when running applications on Connect is that the application is running using the visitor's credentials. This is not the current behavior. Instead, connectapi uses the CONNECT_API_KEY variable, which belongs to the content owner, not the visitor.

Therefore, the default behavior should be as follows:

When running on Connect, assume that a visitor integration is configured. If the integration is not set, provide a sensible error message that directs the user to create the integration or explicitly overrides this behavior. When the integration is set, it assumes the visitor's credentials via the HTTP header.

When running off Connect, assume the current behavior (e.g., CONNECT_API_KEY is set).

(Sibling issue to posit-dev/posit-sdk-py#398)