Add a bearer token to fetch without a client library
Wrap fetch in one function that sets Authorization for a single API origin, so no call site forgets the token and no redirect carries it to another host.
How-to › Section 1
Authenticate and authorize calls#
Get a valid credential onto every request and keep it valid: keys, tokens, OAuth and OIDC flows, signatures and mTLS, from both the client and the producer side.
7 guides in 2 topics. Every guide compares its approaches and shows the output its commands printed.
Send API keys and bearer tokens 6 guides
Static credentials and short-lived tokens on plain HTTP from the client side: header versus query placement, key rotation without dropped requests, per-environment keys, token refresh without a race, scoping to least privilege, detecting leaked keys.
Add an API key with Guzzle middleware in PHP
Add an X-API-Key header to every Guzzle request for one API origin with a `mapRequest` middleware, keep it off redirects to other hosts, and test it offline.
Call a keyed API from a browser without shipping the key
Put the provider's key on a route you control, refuse that route to other sites, and search the bundle for the secret before every release.
Diagnose a 401 or a 403 from a credential
Read the WWW-Authenticate challenge rather than the status code, so a client can tell the credential failures apart and take the action that fixes each.
Keep test and live API keys from crossing environments
Put the environment in the key itself and check it at process start, so a staging deployment holding a production credential refuses to run.
Refresh an access token once under concurrent requests
Hold the refresh in a single promise so concurrent callers await the same request, and callers that all see an expired token make one call to the token endpoint.
Run OAuth 2.1 and OIDC flows 1 guide
Choosing and implementing the flow from the client side: authorization code with PKCE, client credentials, device code, refresh-token rotation, token introspection, OIDC discovery, and why the implicit and password grants are gone.
Run authorization code with PKCE in a single-page app
Log a user into a browser-only app with PKCE, keep the tokens in memory, renew them silently after a reload, and prove nothing is ever written to local storage.
Generate the client instead of writing it#
Retries, timeouts, pagination and auth are the same problems in every client. Voxgig generates them from your OpenAPI description, in 23 languages, from one model.