#authentication

Articles tagged with #authentication

Multiple security schemes in OpenAPI: AND vs OR, optional auth, and per-operation overrides
The security array means OR, any one listed scheme is enough; combining schemes inside one requirement object means AND, all are required. Get this backwards and an endpoint that needs both an API key and a bearer token accepts just one, or a public endpoint demands credentials.
Oct 8, 20266 min read
Document API authentication in OpenAPI 3.1: Bearer, API keys, OAuth 2, and mTLS without the usual mistakes
Most OpenAPI auth docs are subtly wrong: a scheme is defined but never applied, a token is modeled as a plain header, or OAuth scopes do not match the server. Here is how to document each mechanism correctly, combine them with AND/OR semantics, and mark public endpoints.
Oct 6, 20266 min read

#authentication - Powerduck Blogs