[{"data":1,"prerenderedAt":645},["ShallowReactive",2],{"page:\u002Fextensions\u002Fkubb-labs\u002Fplugin-fetch\u002Fguides\u002Fauthentication":3},{"id":4,"frontmatter":5,"title":6,"heading":6,"body":7,"path":644,"source":4},"extensions\u002Fkubb-labs\u002Fplugin-fetch\u002Fguides\u002Fauthentication.md",{},"Authenticate requests",{"type":8,"value":9,"toc":636},"minimark",[10,25,30,33,134,142,146,149,258,261,406,419,425,489,493,500,623,633],[11,12,13,14,18,19,24],"p",{},"Set an ",[15,16,17],"code",{},"auth"," resolver on the generated client. Operations use the ",[20,21,23],"a",{"href":22},"https:\u002F\u002Fspec.openapis.org\u002Foas\u002Fv3.1.0#security-scheme-object","security schemes"," declared in your OpenAPI spec. Requests remain unauthenticated until you provide credentials.",[26,27,29],"h2",{"id":28},"set-the-auth-resolver","Set the auth resolver",[11,31,32],{},"Set the resolver for all secured operations:",[34,35,39],"pre",{"language":36,"code":37,"class":38},"typescript","import { client } from '.\u002Fgen\u002F.kubb\u002Fclient'\n\nclient.setConfig({\n  auth: () => localStorage.getItem('token') ?? undefined,\n})","highlights",[15,40,42,69,70,69,72,69,87,69,129],{"class":41},"language-typescript",[43,44,47,51,55,59,62,65],"span",{"class":45,"style":46},"line","display: inline",[43,48,50],{"style":49},"color:#d73a49;--hls-dark:#f97583","import ",[43,52,54],{"style":53},"color:#005cc5;--hls-dark:#79b8ff","{ ",[43,56,58],{"style":57},"color:#24292e;--hls-dark:#e1e4e8","client ",[43,60,61],{"style":53},"} ",[43,63,64],{"style":49},"from ",[43,66,68],{"style":67},"color:#032f62;--hls-dark:#9ecbff","'.\u002Fgen\u002F.kubb\u002Fclient'","\n",[43,71],{"class":45,"style":46},[43,73,74,77,80,84],{"class":45,"style":46},[43,75,76],{"style":57},"client",[43,78,79],{"style":49},".",[43,81,83],{"style":82},"color:#6f42c1;--hls-dark:#b392f0","setConfig",[43,85,86],{"style":53},"({",[43,88,89,92,94,97,100,103,106,108,111,114,117,120,123,126],{"class":45,"style":46},[43,90,91],{"style":53},"  ",[43,93,17],{"style":53},[43,95,96],{"style":49},": ",[43,98,99],{"style":53},"() ",[43,101,102],{"style":49},"=> ",[43,104,105],{"style":57},"localStorage",[43,107,79],{"style":49},[43,109,110],{"style":82},"getItem",[43,112,113],{"style":53},"(",[43,115,116],{"style":67},"'token'",[43,118,119],{"style":53},") ",[43,121,122],{"style":49},"?? ",[43,124,125],{"style":53},"undefined",[43,127,128],{"style":49},",",[43,130,131],{"class":45,"style":46},[43,132,133],{"style":53},"})",[11,135,136,138,139,141],{},[15,137,17],{}," takes a token string or a function. The function can be async and returns a token, or ",[15,140,125],{}," to skip that scheme. When an operation accepts several schemes, the runtime tries each until one returns a token.",[26,143,145],{"id":144},"return-the-right-token-per-scheme","Return the right token per scheme",[11,147,148],{},"Use the scheme passed to the resolver to select a credential:",[34,150,152],{"language":36,"code":151,"class":38},"type Auth = {\n  type: 'http' | 'apiKey' | 'oauth2' | 'openIdConnect'\n  scheme?: 'bearer' | 'basic'\n  name?: string\n  in?: 'header' | 'query' | 'cookie'\n}",[15,153,154,69,168,69,196,69,216,69,229,69,253],{"class":41},[43,155,156,159,162,165],{"class":45,"style":46},[43,157,158],{"style":49},"type ",[43,160,161],{"style":82},"Auth ",[43,163,164],{"style":49},"= ",[43,166,167],{"style":53},"{",[43,169,170,172,175,177,180,183,186,188,191,193],{"class":45,"style":46},[43,171,91],{"style":53},[43,173,174],{"style":53},"type",[43,176,96],{"style":49},[43,178,179],{"style":67},"'http' ",[43,181,182],{"style":49},"| ",[43,184,185],{"style":67},"'apiKey' ",[43,187,182],{"style":49},[43,189,190],{"style":67},"'oauth2' ",[43,192,182],{"style":49},[43,194,195],{"style":67},"'openIdConnect'",[43,197,198,200,203,206,208,211,213],{"class":45,"style":46},[43,199,91],{"style":67},[43,201,202],{"style":57},"scheme",[43,204,205],{"style":57},"?",[43,207,96],{"style":49},[43,209,210],{"style":67},"'bearer' ",[43,212,182],{"style":49},[43,214,215],{"style":67},"'basic'",[43,217,218,220,223,226],{"class":45,"style":46},[43,219,91],{"style":67},[43,221,222],{"style":57},"name",[43,224,225],{"style":57},"?: ",[43,227,228],{"style":82},"string",[43,230,231,233,236,238,240,243,245,248,250],{"class":45,"style":46},[43,232,91],{"style":82},[43,234,235],{"style":49},"in",[43,237,205],{"style":57},[43,239,96],{"style":49},[43,241,242],{"style":67},"'header' ",[43,244,182],{"style":49},[43,246,247],{"style":67},"'query' ",[43,249,182],{"style":49},[43,251,252],{"style":67},"'cookie'",[43,254,255],{"class":45,"style":46},[43,256,257],{"style":53},"}",[11,259,260],{},"The scheme decides where the runtime puts the token:",[262,263,264,283],"table",{},[265,266,267],"thead",{},[268,269,270,274,280],"tr",{},[271,272,273],"th",{},"Scheme in the spec",[271,275,276,279],{},[15,277,278],{},"Auth"," object",[271,281,282],{},"Where the token goes",[284,285,286,305,322,340,357,374,390],"tbody",{},[268,287,288,295,300],{},[289,290,291,294],"td",{},[15,292,293],{},"http"," bearer",[289,296,297],{},[15,298,299],{},"{ type: 'http', scheme: 'bearer' }",[289,301,302],{},[15,303,304],{},"Authorization: Bearer \u003Ctoken>",[268,306,307,312,317],{},[289,308,309,311],{},[15,310,293],{}," basic",[289,313,314],{},[15,315,316],{},"{ type: 'http', scheme: 'basic' }",[289,318,319],{},[15,320,321],{},"Authorization: Basic \u003Ctoken>",[268,323,324,330,335],{},[289,325,326,329],{},[15,327,328],{},"apiKey"," header",[289,331,332],{},[15,333,334],{},"{ type: 'apiKey', name, in: 'header' }",[289,336,337,338],{},"request header named ",[15,339,222],{},[268,341,342,347,352],{},[289,343,344,346],{},[15,345,328],{}," query",[289,348,349],{},[15,350,351],{},"{ type: 'apiKey', name, in: 'query' }",[289,353,354,355],{},"query parameter named ",[15,356,222],{},[268,358,359,364,369],{},[289,360,361,363],{},[15,362,328],{}," cookie",[289,365,366],{},[15,367,368],{},"{ type: 'apiKey', name, in: 'cookie' }",[289,370,371,329],{},[15,372,373],{},"Cookie",[268,375,376,381,386],{},[289,377,378],{},[15,379,380],{},"oauth2",[289,382,383],{},[15,384,385],{},"{ type: 'oauth2' }",[289,387,388],{},[15,389,304],{},[268,391,392,397,402],{},[289,393,394],{},[15,395,396],{},"openIdConnect",[289,398,399],{},[15,400,401],{},"{ type: 'openIdConnect' }",[289,403,404],{},[15,405,304],{},[407,408,410,411,414,415,418],"blockquote",{"as":409},"note","For basic auth, return the raw ",[15,412,413],{},"username:password"," string. The runtime base64-encodes it and writes the ",[15,416,417],{},"Basic"," prefix, so you never build the header yourself.",[11,420,421,422,424],{},"When a spec mixes schemes, branch on the ",[15,423,278],{}," object and return the matching credential:",[34,426,428],{"language":36,"code":427,"class":38},"client.setConfig({\n  auth: (auth) => (auth.type === 'apiKey' ? apiKey : accessToken),\n})",[15,429,430,69,440,69,485],{"class":41},[43,431,432,434,436,438],{"class":45,"style":46},[43,433,76],{"style":57},[43,435,79],{"style":49},[43,437,83],{"style":82},[43,439,86],{"style":53},[43,441,442,444,446,448,450,452,454,456,458,460,462,464,467,469,472,475,477,480,483],{"class":45,"style":46},[43,443,91],{"style":53},[43,445,17],{"style":53},[43,447,96],{"style":49},[43,449,113],{"style":53},[43,451,17],{"style":57},[43,453,119],{"style":53},[43,455,102],{"style":49},[43,457,113],{"style":53},[43,459,17],{"style":57},[43,461,79],{"style":49},[43,463,158],{"style":53},[43,465,466],{"style":49},"=== ",[43,468,185],{"style":67},[43,470,471],{"style":49},"? ",[43,473,474],{"style":57},"apiKey ",[43,476,96],{"style":49},[43,478,479],{"style":57},"accessToken",[43,481,482],{"style":53},")",[43,484,128],{"style":49},[43,486,487],{"class":45,"style":46},[43,488,133],{"style":53},[26,490,492],{"id":491},"use-a-separate-client-per-environment","Use a separate client per environment",[11,494,495,496,499],{},"To give each environment its own token, such as one per tenant in a multi-tenant app, build an isolated client with ",[15,497,498],{},"createClient",":",[34,501,503],{"language":36,"code":502,"class":38},"import { createClient } from '.\u002Fgen\u002F.kubb\u002Fclient'\n\nconst tenant = createClient({\n  baseURL: 'https:\u002F\u002Ftenant.example.com',\n  auth: () => tenantToken,\n})\n\nconst { data } = await getPetById({ path: { petId: 1 }, client: tenant })",[15,504,505,69,520,69,522,69,536,69,550,69,567,69,571,69,573],{"class":41},[43,506,507,509,511,514,516,518],{"class":45,"style":46},[43,508,50],{"style":49},[43,510,54],{"style":53},[43,512,513],{"style":57},"createClient ",[43,515,61],{"style":53},[43,517,64],{"style":49},[43,519,68],{"style":67},[43,521],{"class":45,"style":46},[43,523,524,527,530,532,534],{"class":45,"style":46},[43,525,526],{"style":49},"const ",[43,528,529],{"style":57},"tenant ",[43,531,164],{"style":49},[43,533,498],{"style":82},[43,535,86],{"style":53},[43,537,538,540,543,545,548],{"class":45,"style":46},[43,539,91],{"style":53},[43,541,542],{"style":53},"baseURL",[43,544,96],{"style":49},[43,546,547],{"style":67},"'https:\u002F\u002Ftenant.example.com'",[43,549,128],{"style":49},[43,551,552,554,556,558,560,562,565],{"class":45,"style":46},[43,553,91],{"style":49},[43,555,17],{"style":53},[43,557,96],{"style":49},[43,559,99],{"style":53},[43,561,102],{"style":49},[43,563,564],{"style":57},"tenantToken",[43,566,128],{"style":49},[43,568,569],{"class":45,"style":46},[43,570,133],{"style":53},[43,572],{"class":45,"style":46},[43,574,575,577,579,582,584,586,589,592,595,598,600,602,605,607,610,612,615,617,619,621],{"class":45,"style":46},[43,576,526],{"style":49},[43,578,54],{"style":53},[43,580,581],{"style":57},"data ",[43,583,61],{"style":53},[43,585,164],{"style":49},[43,587,588],{"style":49},"await ",[43,590,591],{"style":82},"getPetById",[43,593,594],{"style":53},"({ ",[43,596,597],{"style":53},"path",[43,599,96],{"style":49},[43,601,54],{"style":53},[43,603,604],{"style":53},"petId",[43,606,96],{"style":49},[43,608,609],{"style":53},"1 ",[43,611,257],{"style":53},[43,613,614],{"style":49},", ",[43,616,76],{"style":53},[43,618,96],{"style":49},[43,620,529],{"style":57},[43,622,133],{"style":53},[11,624,625,626,628,629,632],{},"To override the client for one request, pass ",[15,627,17],{}," on that single call, which suits a one-off token refresh. An explicit ",[15,630,631],{},"headers"," value you set on a call always wins over the resolved token.",[11,634,635],{},"For authentication outside OpenAPI security schemes, use an async request interceptor to sign requests or supply custom headers.",{"title":637,"searchDepth":638,"depth":638,"links":639},"",5,[640,642,643],{"id":28,"depth":641,"text":29},2,{"id":144,"depth":641,"text":145},{"id":491,"depth":641,"text":492},"\u002Fextensions\u002Fkubb-labs\u002Fplugin-fetch\u002Fguides\u002Fauthentication",1793647025146]