Configuring API authentication - Port Swigger

Summary: PortSwigger's documentation describes how Burp Suite DAST configures API authentication for scanning, covering host credentials for fetching a hosted API definition file and API authentication for requests to endpoints during scanning. It supports basic authentication, Bearer tokens (fixed or dynamic), API keys or custom token locations, and OAuth 2.0 client credentials, and it extracts credentials automatically from uploaded Postman files.
Why it matters: The documentation states that API definitions should include authentication schemes but not the credentials themselves, so detected schemes arrive without credentials and must be populated manually - and scans run against sites with incomplete authentication may leave areas requiring authentication untested.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026