Authorization

Most APIs want to know who is calling. On the Auth tab you pick how the request proves it, fill in the credentials, and ApiWorkbench adds the right header or query parameter every time you send.

If tokens, keys and Basic auth are new to you, read Auth basics first.

Set auth on a request

1. Open the Auth tab of the request.

2. Choose a scheme in Auth type.

3. Fill in the fields that appear.

4. Select Send.

The tab label shows the type, for example Auth • Bearer Token. A short text under Auth type says what the selected type does.

Auth types

Auth type	Use it when	Guide
No Auth	The endpoint is public	This page
Inherit from parent	The folder or collection holds the credentials	This page
Bearer Token	You have an access token	This page
Basic Auth	The API wants a username and password	This page
API Key	The API gave you a key to send in a header or the URL	This page
OAuth 2.0	You sign in with a provider to get a token	OAuth 2.0
OAuth 1.0, Digest Auth, AWS Signature, NTLM, Hawk, Akamai EdgeGrid, JWT Bearer	The API signs requests or uses a challenge	Other auth types

How auth is applied

• It is added when you send. The Auth tab does not write into the Headers or Params tabs. The header or parameter is built at send time and added to the outgoing request.
• It is applied last. Signing schemes see the final method, URL, headers and body. If the Headers tab also has an Authorization row, the one from the Auth tab replaces it.
• Variables work in every field. Write {{token}} instead of pasting a token, and keep the value in an environment. You then change it in one place.
• Secret fields are hidden. Passwords, tokens and keys show as dots. Select the eye icon in a field to show or hide it.
• Redirects. When a redirect leads to a different host, the Authorization header is dropped, so your credentials do not travel to another site. A request's Settings tab can change this.

To see the header that was sent, open the Console.

WARNING

Credentials you type are stored with the request, as plain text in the app's data files, and are included in workspace exports. Use variables for real secrets, mark them Secret, and check what an export contains before you share it. See Variables and environments.

Inherit auth from a folder or collection

Set the credentials once on a collection, and every request inside can use them. When the token changes, you update one place.

Set auth on a collection or folder

1. Open Collections in the side panel.

2. Open the … menu on the collection or folder and select Auth, scripts and docs.

3. On the Auth tab of the settings dialog, choose an Auth type and fill in the fields. For example Bearer Token with the token {{token}}.

4. Select Done.

Make a request inherit

On the request's Auth tab, set Auth type to Inherit from parent and save the request.

The tab then says what the request will use, for example:

Uses Bearer Token from the collection Shop API.

How the parent is found

ApiWorkbench looks upward from the request and stops at the first place that has its own auth:

1. The folder the request is in.
2. Each folder above it.
3. The collection.

A folder starts as Inherit from parent, so it passes the question up until you give it its own auth type. A collection starts as No Auth.

Situation	What is sent
The request's folder has Basic Auth	The folder's Basic auth
No folder has its own auth, the collection has Bearer Token	The collection's bearer token
Nothing above has auth	No credentials
The request is not saved in a collection	No credentials

• A new request starts as No Auth, not as Inherit from parent. Choose inherit yourself.
• Imported requests keep what the source file says. Postman requests that inherit stay inherited.
• No Auth on a request or folder stops the search: nothing is sent, whatever the collection has.

No Auth

Sends no credentials. The tab reads No authentication will be applied. Use it for public endpoints, and to switch off inherited auth for one request.

Bearer Token

Sends a token in the Authorization header. Most modern APIs use this, including tokens you get from a login endpoint or a dashboard.

Field	What to enter
Token	The access token, or a variable such as {{token}}

What is sent:

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...

Do not type the word Bearer in the field. It is added for you.

TIP

Let a login request fill the token. Add a capture such as token = body.access_token to the login request, then use {{token}} here.

Basic Auth

Sends a username and password, base64-encoded, in the Authorization header.

Field	What to enter
Username	The user name
Password	The password, or a variable such as {{password}}

What is sent for the user ada with the password secret:

Authorization: Basic YWRhOnNlY3JldA==

Basic auth only encodes the password, it does not encrypt it. Anyone who sees the header can read it, so use it with https:// addresses.

API Key

Sends a key under a name you choose, as a header or as a query parameter.

Field	What to enter
Key name	The header or parameter name the API expects, such as X-API-Key. Check the API's documentation.
Value	Your key, or a variable such as {{apiKey}}
Add to	Header or Query param

With Header:

X-API-Key: abc123

With Query param, the key is added to the URL:

https://api.example.com/users?api_key=abc123

Prefer Header when the API allows both. A key in the URL can end up in server logs and browser history.

If Key name is empty, nothing is added.

Troubleshooting

The server answers 401 Unauthorized

The credentials are missing or wrong. Open the Console and check the Authorization header that was sent.

• A header that still shows {{token}} means the variable has no value. Check that the right environment is selected.
• With Inherit from parent, read the note on the Auth tab to see where the auth comes from.
• An expired token needs replacing. For OAuth 2.0, see OAuth 2.0.

The server answers 403 Forbidden

The credentials are valid but may not do this. Check the account's permissions or the token's scopes.

More on testing protected APIs: Auth testing.

Next steps

• OAuth 2.0
• Other auth types
• Variables and environments
• Captures