--- title: "Authentication" slug: "ast-authentication" description: "Learn how to configure authentication for Traceable API Security Testing. Explore supported authentication mechanisms, roles, setup steps, and options for validating tokens to ensure successful and secure scan execution." tags: ["API Security", "API Security Testing", "AST Authentication", "Authentication Mechanisms"] status: "update" updated: 2026-01-27T07:27:20Z published: 2026-01-27T07:27:20Z canonical: "traceabledocs.document360.io/ast-authentication" --- > ## Documentation Index > Fetch the complete documentation index at: https://traceabledocs.document360.io/llms.txt > Use this file to discover all available pages before exploring further. # Authentication Traceable’s API Security Testing (AST) allows you to integrate an authentication mechanism into your scans. This is particularly useful when authentication tokens are short-lived or have expired, as expired credentials can prevent scans from completing successfully. For instance, a scan run on live traffic after a long interval may fail if the authentication has expired. DAST scans that rely on OpenAPI specifications can be affected in the same way. Scans on older or suppressed data may also encounter issues if the associated authentication tokens are no longer valid. In these situations, AST requires a fresh authentication token to complete the scan. > [!NOTE] > Note > > The topic assumes that you have reasonable knowledge of authentication mechanisms. For the list of available authentication mechanisms, see [Supported authentication mechanisms](/v1/docs/authentication#supported-authentication-mechanisms). ## What will you learn in this topic? By the end of this topic, you will be able to understand: - The various authentication mechanisms available in AST. - The roles available for the above authentication mechanisms. - The steps to navigate the Authentication page and set up authentication. --- ## Supported authentication mechanisms Traceable supports multiple authentication mechanisms, such as: | Authentication Mechanism | Description | | --- | --- | | **API Key** | Authenticates requests using a static key sent in a header, query parameter, or cookie. For more information, see [API Key](/v1/docs/api-key). | | **Basic Auth** | Authenticates by sending a Base64-encoded username and password in the request header. For more information, see [Basic Auth](/v1/docs/basic-auth). | | **Bearer** | Authenticates requests and grants access using a token that the server trusts based solely on possession. For more information, see [Bearer](/v1/docs/bearer). | | **Content Signature** | Authenticates by signing the request body with a private key, allowing the server to verify integrity. For more information, see [Content Signature](/v1/docs/content-signature). | | **HMAC** | Verifies request integrity and authenticity using a cryptographic hash generated with a shared secret. For more information, see [HMAC](/v1/docs/hmac). | | **JWT** | Uses a signed, self-contained token carrying user claims for authentication and authorization. For more information, see [JWT](/v1/docs/jwt). | | **Mutual TLS** | Authenticates both client and server using TLS certificates during the handshake. For more information, see [Mutual TLS](/v1/docs/mutual-tls). | | **OAuth** | Delegates access using authorization flows where the server issues tokens instead of sharing credentials. For more information, see [OAuth](/v1/docs/oauth-1). | | **PoP Token Signature** | Authenticates by requiring the client to sign each request with a key embedded in the token. For more information, see [PoP Token Signature](/v1/docs/pop-token-signature). | | **Custom Auth** | Allows defining a user-specific authentication mechanism using custom logic. For more information, see [Custom Auth](/v1/docs/custom-auth). | --- ## Feature support matrix for authentication mechanisms The following matrix outlines how each authentication type aligns with form support, code editability, and AI-generated configurations: | Auth Type | Form Type Support | Editable Code | AI-Generated Code | | --- | --- | --- | --- | | **API Key** | ✔️ | ✔️ | ✔️ | | **Basic Auth** | ✔️ | ✔️ | ✔️ | | **Bearer** | ✔️ | ✔️ | ✔️ | | **Content Signature** | ✔️ | ✔️ | ✔️ | | **HMAC** | ✔️ | ✔️ | ✔️ | | **JWT** | ✔️ | ✔️ | ✔️ | | **Mutual TLS** | ✔️ | ✔️ | **X** | | **OAuth** | ✔️ | **X** | **X** | | **PoP Token Signature** | ✔️ | ✔️ | ✔️ | | **Custom Auth** | **X** | ✔️ | ✔️ | --- ## Roles associated with authentication mechanisms You can associate each authentication method with one of the following roles. - Standard - Admin - Reader - Writer Roles define user capabilities, such as view-only or admin actions, allowing the authentication hook to dynamically apply the correct authorization logic and enhance coverage for access-control scenarios. --- ## Navigating the page To configure an authentication, navigate to **Testing** → **Authentication**, and click **Configure Authentication** in the page’s top right corner. --- ## Configuring an authentication mechanism In the Configure Authentication slide-out window, do the following: ![Authentication Configuration](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_ast_authentication_configuration.png) Authentication Configuration 1. Select the **Authentication Mechanism** from the drop-down list. 2. Select the **Role** you wish to assign. 3. Specify a **Name** for the authentication. This is the name you use to identify the authentication mechanism when creating a scan. 4. (Optional) Specify a **Description** for the mechanism. 5. Do one of the following: For more information on the available configurations under a mechanism, see the respective documents. - Specify the configurations according to your requirements. - Click the **Advanced Mode** toggle and write a custom script for the authentication mechanism. 6. Test the authentication mechanism (except for OAuth) to ensure it accurately complies with the specified configurations. For frequently asked questions about authentication and how Traceable stores credentials, see [FAQs](/v1/docs/ast-faqs). Dynamic Application Security Testing (DAST): DAST involves testing an application while it is running to identify vulnerabilities that may not be apparent from analyzing the source code. DAST can help to identify vulnerabilities in the application's runtime environment, such as configuration issues or network vulnerabilities. ## Related - [FAQs](/ast-faqs.md) - [Troubleshooting Guide](/ast-troubleshooting.md)