I'm using a GeoServer master with the authkey module.
For authenticated requests, the WCS services include the authkey token in the xlink:href values
Using WCS 1.0.0, the generated urls are wrong, they append a question mark to the link, assuming the urls do not contain any query parameter.
See the attached GetCapabilities screenshot
WCS 1.1.0 and 2.0.1 does not seem to show this issue.