determine_current_user, and the auth filter that runs early

Custom authentication for the REST API hooks a filter that runs before most of WordPress is loaded, which constrains what is available inside it.

add_filter( 'determine_current_user', function ( $user_id ) {
    if ( $user_id ) {
        return $user_id;      // already authenticated — do not override
    }

    $token = turkerdev_bearer_token();

    return $token ? turkerdev_user_for_token( $token ) : $user_id;
}, 20 );

Returning early when a user is already resolved is not optional — overriding an existing cookie session with a token lookup breaks the admin. The filter runs during plugins_loaded, so a database query is available and most of the API is not, which means anything using current_user_can inside it recurses.