Authentication & Security
Securing Your API
OpenAPI provides comprehensive security scheme definitions that Tigrister fully supports. Define how your API authenticates requests, and Tigrister handles the rest - from UI forms to request headers.
Key Concepts
- • Security Schemes - Define auth methods in components/securitySchemes
- • Global Security - Apply schemes to all operations
- • Operation Security - Override for specific endpoints
- • Scopes - Fine-grained permissions for OAuth2/OIDC
Supported Security Types
Tigrister supports the most common OpenAPI 3.x security scheme types:
| Type | Description | Use Case |
|---|---|---|
| apiKey | Static key in header, query, or cookie | Simple API access, third-party integrations |
| http (basic) | Username + password via Authorization header | Legacy systems, internal tools |
| http (bearer) | Token in Authorization: Bearer header | JWT, access tokens, modern APIs |
| oauth2 | Full OAuth 2.0 with multiple flows | User delegation, third-party apps |
| openIdConnect | OAuth2 + identity via discovery URL | SSO, enterprise identity |
| mutualTLS | Client certificate authentication | Not yet supported |
API Key Authentication
SimpleSend a static key value in a header, query parameter, or cookie. The simplest form of API authentication.
header
Sends: X-API-Key: your-key
query
Sends: ?api_key=your-key
cookie
Sends: Cookie: session=val
Complete Example
HTTP Basic Authentication
LegacyUsername and password encoded as Base64 in the Authorization header. Simple but sends credentials with every request.
Spec Definition
What Gets Sent
Security Note
Basic auth sends credentials with every request. Always use HTTPS. Consider upgrading to Bearer tokens for modern applications.
HTTP Bearer Authentication
RecommendedToken-based authentication using the Authorization: Bearer header. The most common pattern for modern APIs with JWTs.
Spec Definition
What Gets Sent
bearerFormat is informational only - doesn't affect how tokens are sent.
OAuth 2.0
Full FeaturedIndustry-standard protocol for delegated authorization. Supports four flows for different use cases, with optional PKCE for enhanced security.
Authorization Code
Most secure flow for web apps with a backend. User grants permission via browser, backend exchanges code for tokens.
Client Credentials
Machine-to-machine auth without user involvement. Client authenticates directly with its own credentials.
ImplicitLegacy
Token returned directly in URL fragment. No longer recommended - use Authorization Code + PKCE instead.
Password (ROPC)Legacy
Direct username/password exchange. Only for trusted first-party apps or migration from legacy systems.
PKCE (Proof Key for Code Exchange)
Enhanced security for public clients (SPAs, mobile apps). Tigrister supports PKCE for authorization code flows.
1. Generate Verifier
Random string stored client-side
2. Send Challenge
SHA256 hash sent with auth request
3. Verify Exchange
Verifier sent with token request
Complete OAuth2 Example
OpenID Connect
IdentityOAuth2 extension for identity. The discovery URL provides all configuration automatically - endpoints, supported scopes, and token validation keys.
Spec Definition
Discovery Document Contains
- Authorization endpoint URL
- Token endpoint URL
- Supported scopes (openid, profile, email, etc.)
- JWKS (keys for token validation)
How Tigrister Uses OIDC
When you authorize with OIDC, Tigrister fetches the discovery document, shows available scopes, and handles the OAuth2 flow automatically. You receive both an access token (for API calls) and an ID token (user identity).
Operation-Level Security
Override global security for specific endpoints. You can require different auth methods, scopes, or make endpoints public.
Examples
security: []
No auth required (public)
Multiple array items
OR relationship (any one works)
Multiple schemes in one item
AND relationship (all required)
Using Authentication in Tigrister
Once you define security schemes in your spec, Tigrister makes it easy to authorize:
Click "Authorize" Button
Found in both Area Mode (top bar) and Preview (header). Shows all defined schemes.
Enter Credentials
Form adapts to scheme type - text input for API keys, OAuth flow for OAuth2, etc.
Headers Applied Automatically
All requests to secured endpoints include the appropriate auth headers.
Credential Storage
Credentials are stored per-project and shared between Area Mode and Preview. OAuth2/OIDC tokens are kept in memory only and not persisted to disk.
Credential Synchronization
Security credentials are fully synchronized across all views in OpenAPI projects:
Area Mode
Try It Out
Preview
Real-time sync: When you enter or change credentials in any view, they instantly apply everywhere for that endpoint. Authorize once, use everywhere.
Token Management (OAuth2/OIDC)
Tigrister provides full token lifecycle management for OAuth2 and OpenID Connect:
Token Status Indicator
See at a glance if your token is Valid, Expiring soon, or Expired.
Automatic Token Refresh
When a token is about to expire and a refresh token is available, Tigrister automatically refreshes it before making requests.
Expiration Countdown
See exactly when your token expires with a human-readable countdown.
Logout / Clear Token
Clear your token at any time. This removes the access token and refresh token from memory.
Security Best Practices
Use HTTPS Always
All auth methods transmit sensitive data. Never use HTTP in production.
Prefer Bearer Over Basic
Tokens can be revoked and have limited lifetimes. Basic auth exposes credentials.
Use PKCE for Public Clients
SPAs and mobile apps should use Authorization Code + PKCE, not Implicit flow.
Minimize Scope Requirements
Request only the scopes you need. Users trust apps that ask for less access.
Document Your Scopes
Include clear descriptions for each scope so API consumers understand what they grant.