Home / Help centre / Authentication & logins
Authentication & logins
How do I authenticate the scanner with an API key header?
In the scan profile's Authentication section, add a role, tick Header (token / API key), click + Add header, and enter the header name and your API key as the value. Click Save. The scanner sends that header with its requests for this role.
Steps
- Go to Authentication in the profile and click + Add role. Name the role and choose its privilege level.
- Under Authentication methods, tick Header (token / API key). Untick Form if the role has no sign-in page.
- The block starts with the message No headers. Click + Add header to get a row.
- Type the header name in the first box and the key in the second. For many APIs the name is
X-API-Keyor similar, so use whatever your API expects. - Add AI guidance if you like, one step per line. Then press Save.
Good to know
The row has two boxes. Their placeholders show Authorization and Bearer ..., which suits a token. A plain key only needs your own header name and the key as the value. That is all it takes, but the exact header name matters, so copy it from your API's documentation instead of guessing from memory.
| Box | What to enter |
|---|---|
| Name | The header your API reads, such as Authorization |
| Value | The key or token, exactly as the API expects it |
| AI guidance | Optional notes, such as how to treat the key |
Short rule: copy, do not retype. A stray space breaks a key.
You can add several rows if the API wants more than one header. Use a key made for scanning, with only the access the test needs. Rotate it when the scan work ends.
Tokens with a prefix have their own guide, sending a Bearer token. To mix a header with a sign-in form, see combining methods. The key is an API key for your own app. Only test apps you have permission to test.
Once saved, the scanner sends the header with its requests for that role, so confirm the name and the value with a quick manual request before you rely on them.
Related questions
- How do I send a Bearer token in the Authorization header?
- How do I remove a header from a role?
- How do I combine form login and a header token for one role?
- How do I give the scanner AI guidance on how to use a credential?
- Which login methods does Cyberlop support for scanning behind a login?
How to add header token authentication to a scan profile
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.