Automation: Authenticated API scanning with Bearer token

[j2 c]

Hello

I do apologize if this is a redundant question.  I want to automate authenticated API scanning with headless ZAP.

There is a login API where I get the OAuth2 Authorization token.  I need to put that value in the Authorization header of the API request for headless ZAP for authenticated scanning.  How can I do that?

[psiinon]

We have various options - see https://www.zaproxy.org/docs/authentication/

If you have a login page then we have another option, but I'm guessing that as this is an API you might not have one?

Cheers,

Simon

--
You received this message because you are subscribed to the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/85feeb24-5a23-4bd1-98a8-1f18e8f9ea69n%40googlegroups.com.

--

OWASP ZAP Project leader

[j2 c]

I found this thread to be very helpful.  @simon, thank you for responding.

https://groups.google.com/g/zaproxy-users/c/KxtsdtvYQpk/m/Npe98aXIAgAJ