My role only uses an API token, but Form login is ticked. Should I untick it?

Why this happens

A new role starts with Form login ticked. The help text says you can combine methods, for example form plus header, but a role does not need all of them. The capture does not say how Cyberlop treats a ticked method with empty fields, so do not rely on it. Unticking the method you do not use is safe and clear.

How to fix it

1. In the profile, go to Authentication and open the role card.
2. Under Authentication methods, clear Form.
3. Tick Header (token / API key).
4. Click + Add header. Enter Authorization as the name and your value, such as Bearer ....
5. Click Save. The role badges should now show Header.

You can add AI guidance for the header method, one step per line. Examples on the form include telling the agent to send the token on every API request as it is. The privilege level is a separate setting. Set it to User, Elevated or Admin so it matches the account that owns the token, which tells Cyberlop what that role is meant to reach.

Still not working?

On an existing role, stored secrets are never shown again. Leave a field blank to keep the stored value. If the form block holds saved credentials you no longer need, use Clear. Read how to combine auth methods, header and API key authentication and how to clear stored form credentials. Need more? Use the contact page.

Related questions

• How do I combine form login and a header token for one role?
• How do I authenticate the scanner with an API key header?
• How do I send a Bearer token in the Authorization header?
• How do I add a login role to a scan profile?
• Which login methods does Cyberlop support for scanning behind a login?

Full tutorial

How to add header token authentication to a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre