Home / Help centre / Authentication & logins
Help centre
Authentication & logins
Form login, header tokens, OAuth client credentials, TOTP and roles. 36 answers.
How to
- How do I add a login role to a scan profile?
- How do I set a role's privilege level?
- How do I combine form login and a header token for one role?
- How do I set up form login for the scanner?
- How do I choose between the FORM, SSO, API and BASIC login types?
- How do I tell the scanner how to recognise a successful login?
- How do I write the login flow steps?
- How do I handle a login that asks for email and password on separate screens?
- How do I let the scanner get past a TOTP two-factor prompt on my app?
- How do I authenticate the scanner with an API key header?
- How do I send a Bearer token in the Authorization header?
- How do I remove a header from a role?
- How do I set up OAuth 2.0 client credentials for a role?
- How do I request a specific OAuth scope for the scanner's token?
- How do I change the header name or prefix the OAuth token is sent with?
- How do I test the OAuth token exchange before running a scan?
- How do I give the scanner AI guidance on how to use a credential?
- How do I set up two user roles so the scanner can test access between accounts?
- How do I change a stored password on a role?
- How do I edit a role without re-entering its password?
- How do I clear stored form credentials from a role?
- How do I remove a login role from a profile?
- How do I run a scan without any login?
Fix a problem
- What does "No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning." mean?
- Why is the password field empty when I edit my profile?
- What does "Form credentials stored — leave fields blank to keep it." mean?
- Why is the Complete authentication button greyed out?
- My API rejects the OAuth token part-way through a scan. How do I tell the scanner to get a fresh one?
- My app doesn't land on a fixed URL after login. How do I set the success condition?
- Complete authentication didn't return a token. What should I check?
- My role only uses an API token, but Form login is ticked. Should I untick it?
Understand it
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.