Authentication

Toolize speaks every common way an API authenticates a caller, and suggests the right one automatically from the spec.

Supported authentication types

TypeHow it's used
NoneNo credentials sent - for public APIs.
API keyA static key sent as a header or a query parameter, whichever the API expects.
Bearer tokenA static token sent as Authorization: Bearer <token>.
HTTP BasicA username/password pair sent as Authorization: Basic ....
OAuth2 client credentialsToolize fetches an access token from the API's token URL using a client id/secret, caches it, and refreshes it automatically before it expires.

On top of any of these, custom static headers can be stacked - useful for APIs that need something extra, like a tenant id.

Automatic detection from the spec

When importing an OpenAPI spec that declares a securitySchemes object, Toolize reads which scheme is actually required (via the spec's global security requirement) and pre-fills the matching authentication type - so in most cases there's nothing to guess, only credentials to fill in.

  • apiKey schemes map to API key auth, in the same location (header or query) the spec declares.
  • http: bearer maps to bearer token; http: basic maps to basic auth.
  • oauth2 with a clientCredentials flow maps to OAuth2 client credentials, with the token URL pre-filled from the spec.

Changing authentication later

Authentication isn't fixed at import time - update it from the project's page at any time, without re-importing the spec or losing any endpoint selection or tool customization.