What each auth method sends#

One method per request, built when you send so nothing is stored ready-encoded.

Most APIs need to know who you are. The Auth tab on a request holds one authentication method. The app applies that method every time you send. You select a method and fill in its fields. The app attaches the credential when you select Send. The app builds the credential at send time, so it never stores a Basic password or an AWS signature ready-encoded in the request.

The Auth type dropdown open on a request, listing the authentication methods

Select an auth method#

The Auth type dropdown lists every method. Select a method to see its fields and a short line that describes what it sends. Any field accepts a {{variable}}, so you can hold a secret in an environment and reference it here rather than type it into each request. The app masks secret fields such as passwords and keys as you type.

Methods that need one value#

Four methods need nothing more than a value or two.

No auth: sends the request as it is, with no credential attached.
Bearer token: takes a single token. The app sends it as an Authorization: Bearer <token> header.
Basic auth: takes a username and a password. The app base64-encodes the pair into an Authorization: Basic header at send time, not before.
API key: takes a key name and a value, plus an Add to choice of Header or Query param. Header sends the key as a request header. Query param appends it to the URL.

Use No auth for open endpoints. Bearer token is the common choice for APIs that hand you a token to paste in. API key suits an API that expects a named key rather than a bearer token.

Methods with their own page#

The remaining methods have more to configure, so each has its own page.

OAuth 2.0 exchanges credentials for an access token and reuses it.
JWT Bearer signs a token in the app from a payload and a key.
AWS Signature v4 signs the request for API Gateway, S3, Lambda, and similar services.
Digest auth answers a challenge the server sends back.
Inherit auth from parent reuses the auth set on a collection or folder.

Set auth once for a collection#

You do not have to set auth on every request. A collection or folder can define auth. Any request set to Inherit auth from parent then uses it. Set a token once, leave every request on inherit, and change the token in one place. See Inheriting auth.