Authentication
Toolize speaks every common way an API authenticates a caller, and suggests the right one automatically from the spec.
Supported authentication types
| Type | How it's used |
|---|---|
| None | No credentials sent - for public APIs. |
| API key | A static key sent as a header or a query parameter, whichever the API expects. |
| Bearer token | A static token sent as Authorization: Bearer <token>. |
| HTTP Basic | A username/password pair sent as Authorization: Basic .... |
| OAuth2 client credentials | Toolize fetches an access token from the API's token URL using a client id/secret, caches it, and refreshes it automatically before it expires. |
On top of any of these, custom static headers can be stacked - useful for APIs that need something extra, like a tenant id.
Automatic detection from the spec
When importing an OpenAPI spec that declares a
securitySchemes object, Toolize reads which scheme is
actually required (via the spec's global security
requirement) and pre-fills the matching authentication type - so in
most cases there's nothing to guess, only credentials to fill in.
apiKeyschemes map to API key auth, in the same location (header or query) the spec declares.http: bearermaps to bearer token;http: basicmaps to basic auth.oauth2with aclientCredentialsflow maps to OAuth2 client credentials, with the token URL pre-filled from the spec.
Changing authentication later
Authentication isn't fixed at import time - update it from the project's page at any time, without re-importing the spec or losing any endpoint selection or tool customization.