Home / Help centre / Authentication & logins
Authentication & logins
Which login methods does Cyberlop support for scanning behind a login?
Cyberlop supports three methods for scanning behind a login: Form login, Header (token / API key) and OAuth 2.0 client credentials. Tick one or combine several on a role. Leave the Authentication section empty and the scan runs without a login.
The short version
Three methods cover scanning behind a login: Form login, Header (token / API key) and OAuth 2.0 client credentials. You can combine them on one role. With none, the scan runs without a login.
How it works in Cyberlop
| Method | Best for | You provide |
|---|---|---|
| Form | Apps with a sign-in page | Login type, login URL, username, password, optional TOTP secret, success condition, login flow |
| Header (token / API key) | APIs that read a key or token | Header name and value rows |
| OAuth 2.0 | APIs that issue tokens by client credentials | Token URL, client ID, client secret, optional scope |
Form login has four login types: FORM, SSO, API and BASIC. For OAuth 2.0, Cyberlop mints the token and sends it as a header at scan time. Header and OAuth blocks both take optional AI guidance.
Choose the lightest method that works. A static key is the simplest, a form login is the most familiar, and OAuth 2.0 suits APIs that already hand out tokens by client credentials.
Single sign-on for your own Cyberlop workspace is a separate setting under Settings, and it does not affect how the scanner signs in to the app you test.
What to do next
Pick the method that matches your app, then follow its guide: form login, API key header or OAuth 2.0. To mix methods, read combining methods. Background on the idea is in authenticated testing. Test only apps you have permission to test.
Related questions
- How do I choose between the FORM, SSO, API and BASIC login types?
- How do I combine form login and a header token for one role?
- How do I set up form login for the scanner?
- How do I authenticate the scanner with an API key header?
- How do I set up OAuth 2.0 client credentials for a role?
How to scan behind login in Cyberlop with authentication roles
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.