Home / Help centre / Authentication & logins
Authentication & logins
How do I change the header name or prefix the OAuth token is sent with?
In the role's OAuth 2.0 block, edit Header name (default Authorization) and Header prefix (default Bearer, with a trailing space) to match what your API expects. Click Complete authentication to test, then click Save. Cyberlop sends the minted token under that header.
Steps
- Open the role in Authentication with OAuth 2.0 ticked.
- Find Header name. It starts as
Authorization. Replace it if your API reads the token from another header. - Locate Header prefix. It starts as
Bearer, with a space at the end. Type the prefix your API expects, or follow the same pattern with your own word. - Press Complete authentication to confirm that a token still arrives.
- Press Save.
Good to know
| Field | Default | When to change it |
|---|---|---|
| Header name | Authorization | Your API reads the token from a different header |
| Header prefix | Bearer | Your API wants another word before the token |
At scan time, Cyberlop puts the prefix and the token together and sends them under the header name you set. With the defaults, the result looks like Authorization: Bearer <token>.
Mind the space at the end of the prefix. If your API needs one between the word and the token, keep it.
The test button only confirms the token exchange. It does not prove that your API accepts the header. Run a short scan and look at the sitemap to see which endpoints each role reached. Still no luck from your API? See what to do when your API rejects the token.
Changing the name or prefix does not change how the scanner gets the token. Only the way it is sent changes, which is why a mismatch shows up as rejected requests and not as a failed test. Keep notes on which API wants which header.
The whole setup lives in the OAuth 2.0 setup guide.
When an API rejects requests that the test button passed, the header name or prefix is the first thing to check, well ahead of the client ID and secret.
Related questions
- How do I set up OAuth 2.0 client credentials for a role?
- How do I request a specific OAuth scope for the scanner's token?
- How do I test the OAuth token exchange before running a scan?
- How do I send a Bearer token in the Authorization header?
- How does Cyberlop use OAuth 2.0 client credentials during a scan?
OAuth client credentials in Cyberlop: scan APIs with a minted token
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.