Enterprise Edition

Configuring API authentication

• Last updated: February 6, 2025

• Read time: 3 Minutes

You can configure endpoint authentication for API scans. This enables Burp Suite Enterprise Edition to access authenticated endpoints, increasing your scanning coverage.

Burp Suite Enterprise Edition supports the following authentication:

• Basic - Enter a username and password.
• Bearer Token - Adds an access token that's sent in the authorization header.
• API Key / Custom token - Adds an API key or access token in a custom location.

You can also use dynamic tokens. These tokens have a limited lifespan. Burp Suite Enterprise Edition enables you to fetch refreshed tokens automatically.

Adding basic authentication

To add basic authentication:

1. Select the Authentication tab.
2. Click Add API credentials to display the Add Authentication dialog.
3. Select Basic.
4. Enter the Label, Username, and Password.
5. Click Save.

Adding Bearer token authentication

To add Bearer token authentication:

1. Select the Authentication tab.
2. Click Add API authentication to display the Add Authentication dialog.
3. Select Bearer token.

4. For Fixed tokens:

   • Set the Token type to Fixed.
   • Enter the Label and Token.
   • Click Save.

5. For Dynamic tokens:

   • Set the Token type to Dynamic.
   • Enter a Label for the token.
   • Enter the Authentication service URL and Method for the request to retrieve the token.
   • If necessary, expand Additional headers and enter the Name and Value for each header. Click to add more headers.
   • In the Body field, if necessary, enter the body of the request.
   • Enter a value for how often the token should be refreshed in the Re-fetch every field.
   • In the Token location field, enter the location in the response body where the token will be located.
   • Click Save.

Adding API key / custom token authentication

To add credentials for an API key, or add a token in a custom location:

1. Select the Authentication tab.
2. Click Add API authentication to display the Add Authentication dialog.
3. Select API key / Custom token.

4. For Fixed tokens:

   • Set the Token type to Fixed.
   • Enter the Label, Location, and Key / token.
   • Click Save.

5. For Dynamic tokens:

   • Set the Token type to Dynamic.
   • Enter a Label for the token, and choose a location from the Add to drop-down list.
   • Enter the Authentication service URL and Method for the request to retrieve the token.
   • If necessary, expand Additional headers and enter the Name and Value for each header. Click to add more headers.
   • In the Body field, if necessary, enter the body of the request.
   • Enter a value for how often the token should be refreshed in the Re-fetch every field.
   • In the Token location field, enter the location in the response body where the token will be located.
   • Click Save.

Editing or deleting authentication methods

To edit an existing authentication method, click its pencil icon.

To delete an existing authentication method, click its trash icon.