DRONE_ENV_PLUGIN_TOKEN does not allow DRONE_ENV_PLUGIN_ENDPOINT verification via http signature

Drone Support
1

Env variables:
DRONE_ENV_PLUGIN_ENDPOINT=http://host.docker.internal:3980/api/ci/env
DRONE_ENV_PLUGIN_TOKEN=super-duper-secret
DRONE_YAML_ENDPOINT=http://host.docker.internal:3980/api/ci/yaml
DRONE_YAML_SECRET=super-duper-secret

Server use HttpSignature ( http-signature - npm ) package to verify the authenticity and integrity for YAML and ENV endpoints :

async authenticate(req, h) {
      const parsedSignature = HttpSignature.parseRequest(req.raw.req);

      if (!HttpSignature.verifyHMAC(parsedSignature, 'super-duper-secret')) {
        return h.unauthenticated(Boom.unauthorized(`Missing or invalid CI secret`));
      }

      return h.authenticated({
        credentials: {
          user: 'ci',
          scope: ['ci'],
        },
      });
    },

Env endpoint (ENV_PLUGIN_ENDPOINT) returns status code 401.
Although for the Yaml endpoint (DRONE_YAML_ENDPOINT) everything works fine and it returns status code 200.

What’s the difference in checking a shared secret for DRONE_ENV_PLUGIN_ENDPOINT and DRONE_YAML_ENDPOINT?