Defining Multiple Security Schemes and When a Client Sends the Wrong One

Quick answer When an API defines more than one security scheme, the client has to choose correctly, and a wrong choice fails in confusing ways. A service that accepts a bearer token on user endpoints