When using a model deployed to SPCS via its public HTTP endpoint, applications authenticate requests using key pair authentication to generate a JSON Web Token (JWT), then exchange the JWT for an OAuth token, which is subsequently used for authentication. An example shows generating headers including authorization using a session token, formatted as 'Authorization: Snowflake Token=""'. Therefore, options B and D are correct. Option A is incorrect because public endpoints still require authentication. Option C describes internal access via the Snowpark Python API, not external HTTP endpoint authentication. Option E, while relevant for Snowflake Cortex LLM functions accessed via the REST API generally, is not the primary mechanism for authenticating to a SPCS public HTTP endpoint, which uses tokens derived from key pair authentication or session tokens.