hitspec supports 8 authentication methods through the @auth metadata directive. Instead of manually setting Authorization headers, declare your auth strategy once per request and hitspec handles the rest.
Bearer Token
The most common method for API authentication. Sends an Authorization: Bearer <token> header.
Basic Auth
Sends a Base64-encoded Authorization: Basic <credentials> header.
Sends the API key as a custom request header. Specify the header name and value.
API Key (Query String)
Appends the API key as a query parameter instead of a header.
Digest Auth
HTTP Digest authentication. hitspec handles the challenge-response handshake automatically.
AWS Signature v4
Signs requests using AWS Signature Version 4 for authenticating with AWS services or compatible APIs.
The four parameters are:
- Access Key ID - Your AWS access key
- Secret Access Key - Your AWS secret key
- Region - AWS region (e.g.,
us-east-1)
- Service - AWS service name (e.g.,
s3, execute-api)
OAuth2 Client Credentials
Automatically fetches an access token using the OAuth2 Client Credentials grant before sending the request.
Parameters in order:
- Token URL - The OAuth2 token endpoint
- Client ID - Your application’s client ID
- Client Secret - Your application’s client secret
- Scopes - Comma-separated list of scopes (optional)
OAuth2 Password Grant
Fetches an access token using the OAuth2 Resource Owner Password Credentials grant.
Parameters in order:
- Token URL - The OAuth2 token endpoint
- Client ID - Your application’s client ID
- Client Secret - Your application’s client secret
- Username - Resource owner’s username
- Password - Resource owner’s password
- Scopes - Comma-separated list of scopes (optional)
Using Auth with Captures
A common pattern is to capture a token from a login request and use it in subsequent requests:
Auth Syntax Reference
All auth parameters support variable interpolation with {{variableName}} syntax, so you can store credentials in your environment configuration and keep them out of your test files.
