Configure API Client authentication

All authentication fields accept environment variables such as {{ variableName }}. See Environments for reusable values.

Supported schemes#

• HTTP Basic — Username and Password.
• HTTP Bearer — A token sent in the Authorization header.
• API Key — A key in a header, query parameter, or cookie.
• OAuth 2.0 — Authorization code, client credentials, implicit, or password flows.
• OpenID Connect — Provider discovery from .well-known/openid-configuration.

The schemes come from components.securitySchemes. The document or operation security requirement determines which scheme is selected. An empty security requirement makes authentication optional for that operation.

Configure credentials#

Open collection settings and choose Authentication, or open an operation's Authentication tab to override the collection value. Credentials are stored in your workspace and are not exported with the OpenAPI document.

For OAuth 2.0, fill in the flow's form and select Authorize. Scalar opens the provider consent popup for user-facing flows or exchanges credentials directly for machine-to-machine flows. Select Clear to remove stored tokens.

Multiple schemes#

One security requirement with several schemes means every listed scheme is required. Several security requirements mean any one requirement is sufficient.

# AND: both apiKey and oauth are required
security:
  - apiKey: []
    oauth: [read]
 
# OR: either apiKey or oauth is sufficient
security:
  - apiKey: []
  - oauth: [read]

When several schemes are active, the Authentication panel shows a Multiple badge and prompts for each required scheme.