Baton Chapter 8
Authorization
Auth is a property of the request, but most requests should not carry their own.
1 is the default and usually the right answer: the request takes whatever the collection, or the folder above it, defines. Set a bearer token once on the collection and every request in it is authorized; change it in one place when it rotates. 2 and 3 are the methods themselves.
| Method | Notes |
|---|---|
| Inherit | Take the enclosing collection’s or folder’s auth |
| None | Send nothing, even if the collection defines auth |
| Basic | Username and password |
| Digest | Challenge-response; the first 401 is part of the exchange |
| AWS SigV4 | Signed with access key, secret, region and service |
| Bearer | A token in Authorization |
| API key | A named value, in a header or the query string |
| OAuth 2.0 | A flow that fetches a token, then sends it as a bearer |
8.1OAuth 2.0
OAuth is a token acquisition flow, so Baton resolves it before the request is built: a cached or refreshable token keeps it silent, and anything else asks you to authorize from the Auth tab. The authorization page opens in the system browser on desktop, and in the platform’s own authentication session on iOS and Android. Discovery (RFC 8414) and dynamic client registration (RFC 7591) are supported, so an issuer URL is often all that is needed.