Authorization Settings

Create and manage authorization settings in ApyGuard to control how scans authenticate and evaluate protected API behavior.

Overview

Authorization settings define how ApyGuard gains access to protected endpoints during testing. They connect authentication method, token behavior, credentials, and role-based expectations into one reusable configuration.

Method selection

Choose the auth flow that matches your API, such as Predefined Token, Login URL, OIDC, or OAuth2.

Token behavior

Define token format and where the token should appear in requests.

Credential linking

Attach the credential records needed to authenticate successfully.

Role-aware testing

Support authorization matrix testing for different access levels and API behaviors.

Typical setup flow

1. Create a new authorization setting.
   
2. Choose the correct authentication method.
   
3. Add or select credentials.
   
4. Configure token format and token location.
   
5. Review server-detected metadata for OIDC or OAuth2 flows.
   
6. Adjust authorization matrix for your discovered endpoints
   

Related pages

• Authentication Overview
• Credentials
• Authorization Matrix