Home / Help centre / Authentication & logins
Authentication & logins
How do I combine form login and a header token for one role?
Open the profile's Authentication section, add a role, and tick more than one box under Authentication methods, for example Form and Header (token / API key). Fill in each block that opens, then click Save. Cyberlop uses the ticked methods together to authenticate that one role.
Steps
- Start in the profile and choose Authentication in the left-hand switcher.
- Click + Add role, or reopen an existing role card. Type a Name and pick a Privilege level.
- Look at Authentication methods. Tick each one this role needs: Form, Header (token / API key) or OAuth 2.0. Form starts ticked.
- Complete the block for every ticked method. The header and OAuth blocks also take optional AI guidance, so you can tell the scanner how to use the credential.
- Finish with Save.
Good to know
The help text under the checkboxes gives the idea: combine methods to authenticate one role, such as form plus header. A common case is an app where people sign in on a web form while its API also wants a key in a header. The role card then shows a badge for the privilege and the method.
| Method | What you fill in |
|---|---|
| Form | Login type, login URL, username, password, success condition, login flow |
| Header (token / API key) | One or more name and value rows |
| OAuth 2.0 | Token URL, client ID, client secret, scope, header name and prefix |
One role stands for one identity. Need a second identity? Add a second role rather than stacking more methods onto the first. The steps live in how to set up two user roles.
Use a test account made for scanning. Only test apps you have permission to test. Stuck on a field? Ask through /contact.
Related questions
- How do I choose between the FORM, SSO, API and BASIC login types?
- How do I authenticate the scanner with an API key header?
- How do I set up OAuth 2.0 client credentials for a role?
- Which login methods does Cyberlop support for scanning behind a login?
- How do I add a login role to a scan profile?
How to scan behind login in Cyberlop with authentication roles
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.