API Authentication
Secure your API Explorer with authentication. If your OpenAPI spec defines security schemes, Theneo handles auth automatically. For manual setup, you can also configure auth from the editor or using pre-request scripts.
- From your OpenAPI spec (native, zero setup)
- From the Theneo Editor
- Using Pre-Request Scripts from the project dashboard
From your OpenAPI Spec
If your OpenAPI spec defines securitySchemes, Theneo parses and displays authentication automatically — no manual configuration needed. Supported schemes: Basic, Bearer, API Key, and Digest.
1
Define your security scheme
In your OpenAPI spec, add a securitySchemes block under components.
components:
securitySchemes:
basicAuth:
type: http
scheme: basic
2
Reference the scheme on your endpoints
Apply the scheme to individual operations using the security key.
paths:
/example:
get:
security:
- basicAuth: []
3
Re-import your spec in Theneo
Re-import your updated OpenAPI spec. Theneo will populate the Authentication section automatically.
4
Test in the API Explorer
Open any endpoint with a security scheme. The API Explorer will show the correct credential input fields — username and password for Basic Auth, a token field for Bearer, or a named key field for API Key. Credentials are encoded and applied to requests automatically.
How authentication appears across Theneo
Once your spec is imported, authentication surfaces in three places:
The published documentation shows a dedicated Authentication section on endpoints that use Basic Auth, styled consistently alongside parameter rows. It displays the scheme name and the username and password fields. For Bearer, API Key, and Digest schemes, authentication is reflected in the standard headers section.
For endpoints using Basic Auth, a read-only Authentication tab appears in the editor, separate from Headers and Parameters. It shows the scheme type and field names parsed from your spec. This tab is read-only — to change auth, update your OpenAPI spec and re-import. For other scheme types, auth details appear within the Headers tab.
The API Explorer renders credential input fields based on the auth type. Basic Auth shows separate username and password fields (password is masked with a show/hide toggle). Bearer shows a single token input. API Key shows a field labeled with the key name from your spec. Credentials are encoded and applied to the request automatically — no need to manually set an Authorization header.
From the Theneo Editor
1
Open the API Management widget
- Open your project in the editor.
- Select the API Management widget for the endpoint you're documenting.
2
Open the Header tab
- In the Header tab, you'll see suggested key options.
- Select Authentication from the list.
3
Add authentication info
- Enter a sample value for the authentication header (it can be updated in the API Explorer).
- Optionally add a description or any other properties your API requires.
Using pre-request scripts
For more advanced use cases, configure authentication with a pre-request script:
1
Open Project Settings
From the project dashboard, go to Project Settings.
2
Set an authentication header
For example, to set an Authorization header:
const token = theneo.variables["authToken"];
theneo.headers["Authorization"] = `Bearer ${token}`;
In your pre-request script you can also call other endpoints or set headers dynamically using the Fetch API. This example retrieves an authorization token from Theneo variables and applies it to the Authorization header.
For more, see the Pre-Request Scripting guide.
On this page
- API Authentication