Authenticate requests

Set an auth resolver on the generated client. Operations use the security schemes declared in your OpenAPI spec. Requests remain unauthenticated until you provide credentials.

Set the auth resolver

Set the resolver for all secured operations:

import { client } from './gen/.kubb/client'

client.setConfig({
  auth: () => localStorage.getItem('token') ?? undefined,
})

auth takes a token string or a function. The function can be async and returns a token, or undefined to skip that scheme. When an operation accepts several schemes, the runtime tries each until one returns a token.

Return the right token per scheme

Use the scheme passed to the resolver to select a credential:

type Auth = {
  type: 'http' | 'apiKey' | 'oauth2' | 'openIdConnect'
  scheme?: 'bearer' | 'basic'
  name?: string
  in?: 'header' | 'query' | 'cookie'
}

The scheme decides where the runtime puts the token:

When a spec mixes schemes, branch on the Auth object and return the matching credential:

client.setConfig({
  auth: (auth) => (auth.type === 'apiKey' ? apiKey : accessToken),
})

Use a separate client per environment

To give each environment its own token, such as one per tenant in a multi-tenant app, build an isolated client with createClient:

import { createClient } from './gen/.kubb/client'

const tenant = createClient({
  baseURL: 'https://tenant.example.com',
  auth: () => tenantToken,
})

const { data } = await getPetById({ path: { petId: 1 }, client: tenant })

To override the client for one request, pass auth on that single call, which suits a one-off token refresh. An explicit headers value you set on a call always wins over the resolved token.

For authentication outside OpenAPI security schemes, use an async request interceptor to sign requests or supply custom headers.

See also

• Add interceptors
• Set the base URL