Home / Help centre / Authentication & logins
Authentication & logins
What kind of instructions belong in a role's AI guidance?
AI guidance is optional free text on an authentication role. Use one short line per step to say what the credential represents, how to send it, and what to do when a request is rejected. Keep real secrets in the credential fields, never in the guidance.
The short version
AI guidance tells the scanner how to treat a credential. It does not replace the credential. Think of a short note you would hand a colleague who is about to test your app with a key you gave them.
The box is optional. You write one step per line.
How it works in Cyberlop
Each role can combine methods: Form, Header (token / API key) and OAuth 2.0. The Header and OAuth 2.0 blocks each have an AI guidance textarea. The form shows example lines, and they are a good model for your own.
| Method | Example line from the form |
|---|---|
| Header | Treat this as an admin API key |
| Header | Send it on every API request as-is; do not refresh it |
| Header | Watch for endpoints that ignore it and fall back to a session cookie |
| OAuth 2.0 | Prefer the freshly minted OAuth 2.0 access token |
| OAuth 2.0 | If a request is rejected, re-mint rather than reusing an expired token |
| OAuth 2.0 | refresh_token / id_token can be used where an endpoint expects them |
Good guidance covers three things. Say what the credential is, such as an admin key or a read-only user. Say how to use it, such as on every API request. Say what to do when it fails, such as minting a new token.
Keep the guidance honest and narrow. If you tell the scanner a key is an admin key, it will treat the endpoints it reaches as admin ones, so the note should match what the credential can really do. Short lines are easier to follow than long paragraphs. Short.
What to do next
- Open the profile, go to Authentication and pick the role.
- Type one instruction per line in AI guidance.
- Keep each line to one idea. Plain words work best.
- Leave out passwords, keys and personal data. Those belong in the credential fields, which are stored encrypted and never shown again.
- Click Save.
For the full role setup, read how to scan behind login with authentication roles. If a token keeps failing, see what to do when your API rejects the OAuth token.
Related questions
- My API rejects the OAuth token part-way through a scan. How do I tell the scanner to get a fresh one?
- How do I authenticate the scanner with an API key header?
- How do I set up OAuth 2.0 client credentials for a role?
- Which login methods does Cyberlop support for scanning behind a login?
- What is an authentication role?
How to scan behind login in Cyberlop with authentication roles
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.