Authentication

Veyak has built-in authentication support so you never need to manually type Authorization headers.

Auth Types

Type Use Case
None Public APIs, no auth required
Basic Username + password auth
Bearer JWT / OAuth 2.0 token auth
API Key Key in header or query param

Select an auth type in the Auth tab of the request editor.

None

No authentication headers are added. Use this for public endpoints.

Basic Auth

Veyak automatically base64-encodes username:password and adds it as an Authorization header.

Fields:

  • Username — Your username
  • Password — Your password

The generated header:

Authorization: Basic dXNlcjpwYXNzd29yZA==

Note: Basic auth sends credentials in every request. Always use HTTPS.

Bearer Token

Adds a Bearer prefix and inserts your token into the Authorization header.

Field:

  • Token — Your JWT or OAuth access token

The generated header:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

This is the most common auth type for modern REST APIs and OAuth 2.0 flows.

API Key

Adds your API key either as a header or a query parameter.

Fields:

  • Key — The header/param name (e.g., X-API-Key, api_key)
  • Value — Your API key value
  • Add To — Choose Header or Query Parameter

As a header:

X-API-Key: your-secret-key-here

As a query parameter:

https://api.example.com/data?api_key=your-secret-key-here

Using Environment Variables

You can reference environment variables in any auth field using the {{variable}} syntax:

Bearer {{ACCESS_TOKEN}}

This makes it easy to switch between environments (dev/staging/production) without re-entering credentials. See Environments for setup.

Application User Authentication (Cloud Sync)

In addition to API request authentication, Veyak supports desktop user account login to sync workspaces:

  • Auth0 PKCE Flow — Powered by crates/veyak-auth. Clicking Sign In in the top right user menu launches an OAuth PKCE challenge and starts a temporary local loopback server (tauri-plugin-oauth) on an ephemeral localhost port.
  • Browser Authentication — Your default browser opens the secure Auth0 login portal. Upon completing authentication, the browser redirects back to http://localhost:<port>/callback.
  • Token Exchange & User Profile — Veyak securely captures the authorization code, exchanges it for access tokens, fetches your user profile, displays your avatar, and persists your credentials safely in auth.yaml.
  • Sign Out — Revokes active tokens remotely and clears local credentials.

Tips

  • API Auth settings are persisted per request in your collection.
  • The auth tab shows a preview of the generated header.
  • Use Bearer for JWT tokens obtained via OAuth 2.0 flows.
  • Use API Key for services like OpenAI, Stripe, etc.
  • Sign in to your Veyak Account to synchronize workspaces across desktop environments.