How do I give the scanner AI guidance on how to use a credential?

Steps

1. Open the role in Authentication. The AI guidance box sits inside the Header (token / API key) block and the OAuth 2.0 block, so tick one of them.
2. Find AI guidance (one step per line, optional).
3. Write each instruction on its own line, in plain words. Say what the credential is and how to treat it.
4. Press Save.

Good to know

The product docs say each role can take free-text AI guidance. It is optional. The placeholder lines show the style:

• Name the key: Treat this as an admin API key.
• Explain how to send it: Send it on every API request as-is; do not refresh it.
• For OAuth: Re-mint the token rather than reusing an expired one.

Good guidance is short, true and specific to the credential. Skip secrets. The key itself has its own field, so keep it out of this box.

Keep each line to one idea. A short line is easy to read and hard to misread. Aim for what a new teammate would need to know on day one.

Guidance helps the scanner use the credential well, and it costs nothing to leave it empty when the credential needs no explanation. It does not widen what the role can reach. For more samples, read AI guidance examples. Setup of the credential itself is in the API key header guide and the OAuth 2.0 guide.

Related questions

• What kind of instructions belong in a role's AI guidance?
• How do I authenticate the scanner with an API key header?
• How do I set up OAuth 2.0 client credentials for a role?
• Which login methods does Cyberlop support for scanning behind a login?
• What is an authentication role?

Full tutorial

How to scan behind login in Cyberlop with authentication roles

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre