APIForge

OpenAPI Bearer Token & OAuth 2.0 Security Schemes Example

How to declare securitySchemes and operation-level security requirements in OpenAPI 3.0 specs.

  • Example
  • API security
  • Published

The problem

Undocumented security schemes prevent client code generators and automated testing tools from configuring authentication headers properly.

AvoidThe anti-pattern

YAMLbad-pattern.yaml
paths:
  /v1/protected-data:
    get:
      summary: Protected endpoint

No components.securitySchemes defined; endpoints lack authorization requirements.

PreferThe refactored version

YAMLgood-pattern.yaml
openapi: 3.0.3
paths:
  /v1/protected-data:
    get:
      summary: Protected data resource
      security:
        - BearerAuth: []
      responses:
        '200':
          description: Success
        '401':
          description: Unauthorized
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

Explicit Bearer JWT securityScheme attached to globally or operationally scoped security blocks.

How APIForge checks this

  • Checks for global and path security requirement declarations
  • Validates securityScheme component configurations
Share
X (opens in a new tab)LinkedIn (opens in a new tab)