Authentication

RESTK supports all major API authentication methods out of the box. Configure auth at the request, folder, or collection level, and RESTK automatically injects the correct credentials into every request.

Supported Auth Types

You can also set auth to Inherit to use the parent folder or collection's auth configuration.

Bearer Token

Bearer token authentication sends a token in the Authorization header with every request.

Setup

How It Works

When you send the request, RESTK injects the following header:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Dynamic Tokens via Scripts

You can also set bearer tokens programmatically in a pre-script:

// Pre-script: Set token from variable
nova.request.setBearerToken(nova.variable.get("access_token"));

Or extract and store a token from a login response:

// Post-script: Extract token from response
const data = nova.response.json();
if (data && data.access_token) {
  nova.variable.set("access_token", data.access_token);
}

API Key

API key authentication sends a key as either a header or a query parameter.

Setup

Configuration

Header example:

X-API-Key: sk_live_abc123

Query parameter example:

https://api.example.com/users?api_key=sk_live_abc123

Basic Auth

Basic authentication sends a Base64-encoded username and password in the Authorization header.

Setup

How It Works

RESTK constructs the header as follows:

Authorization: Basic base64(username:password)

For example, with username admin and password secret123:

Authorization: Basic YWRtaW46c2VjcmV0MTIz

You can also set Basic auth in a pre-script:

nova.request.setBasicAuth("admin", nova.variable.get("admin_password"));

JWT Generation

RESTK can generate and sign JWT tokens directly, which is useful for testing APIs that require custom JWTs.

Creating a JWT

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": {{$timestamp}},
  "exp": {{$timestamp}} + 3600,
  "role": "admin"
}

Supported Algorithms

Auth Inheritance

Authentication settings cascade from collections to folders to requests, reducing repetitive configuration.

How Inheritance Works

Collection Auth (Bearer Token: {{api_token}})
  |
  +-- Folder: Users (Inherit from Collection)
  |     +-- GET /users          --> Uses collection's Bearer Token
  |     +-- POST /users         --> Uses collection's Bearer Token
  |
  +-- Folder: Public (Auth: None)
  |     +-- GET /health         --> No auth sent
  |     +-- GET /status         --> No auth sent
  |
  +-- Folder: Admin (Auth: Basic Auth)
        +-- DELETE /users/:id   --> Uses folder's Basic Auth

Inheritance Rules

1. Inherit (default): The request uses the auth from its parent folder, or the collection if no folder auth is set
2. Override: Set a specific auth type on a folder or request to override the parent
3. None: Explicitly set auth to None to send no credentials, even if a parent has auth configured

Storing Secrets Securely

RESTK takes a privacy-first approach to credential storage.

Keychain Integration

On macOS, authentication credentials such as passwords, tokens, and client secrets are stored in the system Keychain. This provides OS-level encryption and access control.

Encrypted Variables

For secrets that need to be referenced across requests, use Secret Variables.

Best Practices

1. Use variables for tokens -- Store tokens in environment variables so you can switch between dev, staging, and production without editing auth settings
2. Set auth at the collection level -- Configure auth once on the collection and let requests inherit it
3. Use Secret variables -- Mark sensitive values as secrets to mask them in the UI
4. Automate token extraction -- Use post-scripts to extract and store tokens from login responses
5. Test with different auth -- Override auth on individual requests to test permission boundaries
6. Rotate credentials regularly -- Update stored tokens and API keys periodically

Next Steps