Configuring authentication for API scans - Port Swigger
Summary: PortSwigger's documentation describes how Burp Suite Professional configures authentication for API-only scans, supporting Basic authentication, bearer tokens, and API keys, with fixed or dynamic token options. When an OpenAPI definition or Postman Collection is uploaded, Burp parses it to identify endpoints and detect authentication methods, labeling them Detected or Unsupported, while SOAP APIs require all authentication methods to be added manually.
Key Takeaway: Burp prevents saving new manual authentication methods that conflict with existing ones, but allows manual methods to conflict with Detected methods because Detected methods are tied to specific endpoints while manual methods cover all other requests - a conflict that can send invalid credentials and cause the server to deny the request.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026