HttpApiSecurity
Defines security scheme declarations for declarative HTTP APIs.
Security schemes describe where credentials are read from and which credential type is passed to security middleware. They are consumed by HttpApiMiddleware.Service, HttpApiBuilder, generated clients, and OpenAPI generation, but they do not authenticate requests by themselves.
Annotations
Signature
declare const annotate: {
<I, S>(service: Key<I, S>, value: S): <A extends HttpApiSecurity>(self: A) => A;
<A extends HttpApiSecurity, I, S>(self: A, service: Key<I, S>, value: S): A;
};annotateMerge
Merges OpenAPI annotations into a security scheme.
Signature
declare const annotateMerge: {
<I>(annotations: Context<I>): <A extends HttpApiSecurity>(self: A) => A;
<A extends HttpApiSecurity, I>(self: A, annotations: Context<I>): A;
};Constructors
Creates an API key security scheme.
When to use
Use to require API key credentials passed through a header, query parameter, or cookie.
Details
Use HttpApiBuilder.middlewareSecurity to implement API middleware for this security scheme.
Use HttpApiBuilder.securitySetCookie to set the correct cookie in a handler. By default, in is "header".
See
Signature
declare function apiKey(options: {
readonly in?: "cookie" | "header" | "query";
readonly key: string;
}): ApiKey;Creates an HTTP Basic authentication security scheme.
When to use
Use to require HTTP Basic username/password credentials.
Details
Use HttpApiBuilder.middlewareSecurity to implement API middleware for this security scheme.
See
Signature
declare const basic: Basic;Creates a Bearer token security scheme.
When to use
Use to require Authorization: Bearer ... credentials for an HTTP API group or endpoint.
Details
Use HttpApiBuilder.middlewareSecurity to implement API middleware for this security scheme.
See
Signature
declare const bearer: Http;Creates a Http token security scheme.
When to use
Use to require Authorization: scheme ... credentials for an HTTP API group or endpoint.
Details
Use HttpApiBuilder.middlewareSecurity to implement API middleware for this security scheme.
See
Signature
declare function http(options: { readonly scheme: string }): Http;Models
API key security scheme identifying the key name and whether it is read from a header, query parameter, or cookie.
Signature
interface ApiKey extends Proto<Redacted> {
readonly _tag: "ApiKey";
readonly in: "cookie" | "header" | "query";
readonly key: string;
}HTTP Basic authentication security scheme whose decoded credential is Credentials.
Signature
interface Basic extends Proto<Credentials> {
readonly _tag: "Basic";
}Credentials interface
Decoded credentials for HTTP Basic authentication.
Signature
interface Credentials {
readonly password: Redacted;
readonly username: string;
}Http token security scheme whose decoded credential is a redacted token.
Signature
interface Http extends Proto<Redacted> {
readonly _tag: "Http";
readonly scheme: string;
}HttpApiSecurity type
Union of security schemes supported by the HTTP API OpenAPI model.
Signature
type HttpApiSecurity = Http | ApiKey | Basic;Other
HttpApiSecurity
Helper types for HTTP API security schemes.
Adds an OpenAPI annotation value to a security scheme.