I don't have any readily available examples, unfortunately. I'll be honest, this is an area where I'm not an expert; I fiddle around until things start working. The starting point is the documentation for the API you're working with: do they expect a request header? Unfortunately, most documentation assumes you are familiar with all this, so when you're not, it can be a little overwhelming.

Assuming it is a header you need to send, the API documentation should tell you what it's called. The WF screen has a number built-in header names to choose from, including Authorization, but you can type in anything in case they use something unique.

Then, you'll need to send over the right thing. It may be an API key or a username/password. My experience with user/pass is that you have to type it out like USERNAME:PASSWORD and then run that whole thing through a converter to make it a base-64 encoded string (you can find them easily via Google). In that case, I make a custom token to hold the encoded version and then use that for the header.