Authentication
Set auth on the request’s Auth tab, or on a folder or the collection so every request inside inherits it. Choose Inherit on a request to use its parent’s auth.
| Type | Notes |
|---|---|
| Bearer token | Sent as Authorization: Bearer …. |
| Basic | Username and password. |
| API key | In a header or a query parameter. |
| OAuth 2.0 | Client credentials, password, and authorization code with PKCE. |
| OAuth 1.0 | Signed requests. |
| AWS Signature v4 | Access key, secret key, region and service. |
| Digest | Challenge-response username and password. |
| NTLM | Windows-integrated auth for on-prem services. |
| WSSE | UsernameToken for SOAP services. |
| mTLS | A client certificate, configured in the collection settings. |
OAuth 2.0 in your browser
Section titled “OAuth 2.0 in your browser”The authorization code flow opens your system browser, the one that already has your password manager, SSO session and MFA. Vegha listens on a loopback address for the redirect and exchanges the code locally. PKCE is used by default.
In Remote-SSH, WSL and Codespaces windows the browser opens through VS Code, so the loopback redirect still reaches the engine on the remote side.
Keep credentials out of git
Section titled “Keep credentials out of git”Use {{variables}} in auth fields and put the values in an environment, ideally as secret
variables or secret:// references. See Environments & variables.
The git secret guard warns you when a literal credential is
about to be committed.
For details on each auth type’s fields, see the desktop docs on authentication. The engine is the same.