Monitor Authentication
APIContext's authentication manager lets you define reusable authentication settings that any monitor in your project can use. Configure it once, attach it to as many monitors as you need, and APIContext sends the credentials with every request.
Configuring Monitor Authentication requires the EDITOR role or higher. See Access Roles for the full permission matrix.
How it works
Authentication in APIContext has two layers:
| Layer | What it is | Where you manage it |
|---|---|---|
| Auth Setting | The credential configuration (OAuth app, API key, certificate) | Configure Monitoring → Monitor Authentication |
| Token | The active credential derived from the setting (access token, key value) | On the Auth Setting's page, in its tokens table |
When you attach an Auth Setting and a token to a monitor, APIContext injects the token into every request. It renews an expired OAuth 2 token that has a refresh token or uses the Client Credentials grant, and runs your refresh workflow for a Manual Setup token. Other tokens stay as they are until you change them. See Troubleshoot expired authentication tokens.
Supported authentication types
API Key
Pass a static key in a header or query parameter. Use this for services that issue long-lived API keys. In the Authentication Type list, choose API key in request / Manual Setup.
→ Setting up API key authentication
Basic Auth
Send a username and password in an Authorization: Basic header. Create the setting with the Basic Auth type, then add a token that holds the username and password.
OAuth 2 (Authorization Code, Client Credentials, Device Code)
APIContext handles the OAuth flow without any code. Configure the OAuth app details (Client ID, Secret, token URL, scopes) and APIContext renews the token when the provider issued a refresh token or you use the Client Credentials grant. Otherwise, sign in again when the token expires.
→ Fundamentals of OAuth in APIContext → Example OAuth setup → Device Code authorization flow → Troubleshoot expired authentication tokens
Fixed Bearer Token
Provide a static Bearer token. APIContext passes it as Authorization: Bearer <token> on every request. No refresh; rotate manually.
Custom authentication (Manual)
For non-standard flows, use the API key in request / Manual Setup type to specify exact headers and parameters per token, save extracted values as variables, and use EXPIRES_IN to drive refresh.
Mutual TLS (mTLS)
Attach a client certificate to an Auth Setting to authenticate at the TLS layer. Upload your certificate under Certificates first.
→ Handling Mutual TLS → Upload a signing certificate
Authentication in workflows
To use a token obtained in one monitor as input to subsequent monitors, use a workflow. A monitor POSTs to the token endpoint and captures the token via Conditions. The captured value is saved as a variable into the Auth Token. Downstream monitors in the workflow use that variable. The steps are in the guide below.
→ Authentication in a workflow
The basics
New to authentication settings? Start here:
→ The Basics: auth settings and tokens
See also
- Access Roles: who can create and edit Auth Settings
- Troubleshoot expired authentication tokens: restore monitoring when a credential lapses
- Set conditions on a monitor: extract values for use as variables
- Copy or move an authentication setting: reuse a setting in another project, or move it with its monitors