Choose how a request signs in

Set a project's default profile and decide what each request and environment inherits.

In short

An authentication profile is the credential sent to the API you are testing - a token, a password, an API key or an OAuth client. A project has a default profile, an environment can name its own, and each request chooses Inherit, None or one profile. Teammates who run a request use the credential without seeing it.

Before you start

• Who: choosing a profile on a request is a change to the request and needs Edit. Making profiles and choosing the project's default needs Manage on the project.
• Plan: every plan.
• First: have the credential (token, key or password) ready; it is saved encrypted.

Steps

1. Open "Project settings", "Authentication", choose "New profile", pick the kind (for example Bearer token), name it, paste the secret and press "Save profile".
2. Under "Default profile", choose it. Every request in the project now inherits it.
3. For one request that needs another account, pick a different profile on its "Auth" tab. Choose "Inherit" to go back.
4. For an environment with its own credentials, open "Project settings", "Environments", "Advanced", "Authentication".

Result: the line under the Auth control says which profile a request uses right now.

Inherit, None or a profile

Example: keep two organizations in two projects, each with its own default profile holding its own token. Staging and production of one project can name different profiles for the same requests.

Good to know

• Your {{brand}} sign-in decides who you are in this product. API authentication is what is sent to the outside API. Signing in here does not sign you in there.
• When a request runs from Send, Run all, a suite or a monitor, the server adds the profile's credentials.
• An explicit Authorization header on the request always wins.
• Each profile in the list says what uses it - the project default, environments and requests by name. A profile still in use cannot be deleted; switch those first.
• A profile warns before it stops working: Expires soon a week before a token runs out, Expired after. A pasted bearer token that is a JWT is read for its end date. OAuth clients with a refresh token or client credentials, and login requests, renew themselves and never warn.

If something goes wrong

• 401 or 403 answers: the token expired, or the wrong profile is inherited. Read the line under the Auth control - it shows Expired or Expires soon when the profile's token runs out - and replace the token.
• Nothing is sent although the project has a profile: the request is set to None, or the environment says No authentication.

Related

• /help/api-testing/authentication-profiles
• /help/api-testing/variables