Add a bearer token to fetch without a client library
Wrap fetch in one function that sets Authorization for a single API origin, so no call site forgets the token and no redirect carries it to another host.
How-to › Section 1
Authenticate and authorize calls#
Get a valid credential onto every request and keep it valid: keys, tokens, OAuth and OIDC flows, signatures and mTLS, from both the client and the producer side.
13 guides in 4 topics. Every guide compares its approaches and shows the output its commands printed.
- Send API keys and bearer tokens 8
- Run OAuth 2.1 and OIDC flows 3
- Design an authentication scheme for your API 1
- Sign requests and use mTLS 1
Send API keys and bearer tokens 8 guides
Static credentials and short-lived tokens on plain HTTP from the client side: header versus query placement, key rotation without dropped requests, per-environment keys, token refresh without a race, scoping to least privilege, detecting leaked keys.
Add an API key with Guzzle middleware in PHP
Add an X-API-Key header to every Guzzle request for one API origin with a `mapRequest` middleware, keep it off redirects to other hosts, and test it offline.
Call a keyed API from a browser without shipping the key
Put the provider's key on a route you control, refuse that route to other sites, and search the bundle for the secret before every release.
Catch a leaked API key before it reaches the repository
Layer a gitleaks hook, GitHub push protection, a TruffleHog scan in CI, and a Thinkst canary key, then plant a key to prove which layer catches it and when.
Choose between header and query placement for an API key
Pick where an API key travels, header, query string, or cookie, by sending each form through a logging proxy and reading back which records keep the key.
Diagnose a 401 or a 403 from a credential
Read the WWW-Authenticate challenge rather than the status code, so a client can tell the credential failures apart and take the action that fixes each.
Keep test and live API keys from crossing environments
Put the environment in the key itself and check it at process start, so a staging deployment holding a production credential refuses to run.
Refresh an access token once under concurrent requests
Hold the refresh in a single promise so concurrent callers await the same request, and callers that all see an expired token make one call to the token endpoint.
Run OAuth 2.1 and OIDC flows 3 guides
Choosing and implementing the flow from the client side: authorization code with PKCE, client credentials, device code, refresh-token rotation, token introspection, OIDC discovery, and why the implicit and password grants are gone.
Get a client credentials token for calls between services
Get a machine token with grant_type=client_credentials, name the API by audience or scope, cache it until it nears expiry, and prove it by counting token requests.
Run authorization code with PKCE in a single-page app
Log a user into a browser-only app with PKCE, keep the tokens in memory, renew them silently after a reload, and prove nothing is ever written to local storage.
Run the client credentials flow inside a generated SDK
Make the generated client fetch and renew its own machine token, through a generator setting or a feature you write, and prove that one token serves many calls.
Design an authentication scheme for your API 1 guide
The producer side: API keys versus OAuth 2.1 versus OIDC, scope design that limits blast radius without blocking common tasks, key formats and prefixes for secret scanning, token lifetimes, revocation, service accounts, per-customer keys, and the resource-server rules that let MCP clients and agents authenticate.
Enforce scopes at the resource server, not in the client
Turn the scope table in your OpenAPI document into checks on every request, prove them with a negative test suite, and answer refusals as 403 problems.
Sign requests and use mTLS 1 guide
Proving who sent the request: HMAC signatures in the AWS SigV4 style, HTTP Message Signatures (RFC 9421), JWT client assertions, and mutual TLS with certificate rotation, on both sides.
Authenticate to the token endpoint with a client assertion
Build a short-lived, single-use JWT, sign it with the client's private key, post it as client_assertion in place of a secret, and watch a reused one be refused.
Generate the client instead of writing it#
Retries, timeouts, pagination and auth are the same problems in every client. Voxgig generates them from your OpenAPI description, in 23 languages, from one model.