Bearer Token auth sends your token in the Authorization header of every request the API makes. It’s the scheme used by most modern APIs. This page configures it on an existing API; if you haven’t created one yet, start with Your first API connection.

Quick version:

1. Go to HuxxConnect → APIs and click Configure on your API.
2. In API Configuration, set Auth Type to Bearer Token.
3. Paste your token into Token (or constant name).
4. Click Save API.

Every request now sends Authorization: Bearer <your-token>.

Configure the API#

New to APIs? Read this first

A bearer token is a secret string your API provider gives you, usually from a dashboard page called “API keys” or “Tokens”. Whoever holds it gets access, so treat it like a password. Background: Understanding API authentication.

1. Go to HuxxConnect → APIs and click Configure on the API.
2. In the API Configuration section, set Auth Type to Bearer Token.
3. A Token (or constant name) field appears. Paste the token exactly as the provider issued it — without any Bearer prefix. HuxxConnect adds the prefix for you.
4. Click Save API. The token is encrypted before it is stored (see Choose an encryption tier).

To keep the token out of the database entirely, enter an ALL_CAPS constant name or an env:VAR_NAME reference in the same field — see Store credentials outside the database.

What gets sent#

With the token field set to hxc_example_token_123 (// Replace with your real token.), every request to any endpoint of this API carries the header:

GET /v2/reports HTTP/1.1
Host: api.example.com
Authorization: Bearer hxc_example_token_123

Source: src/Auth/Providers/BearerTokenAuth.php — the provider sets Authorization to Bearer followed by your token.

Verify it works#

Expand an endpoint on the same screen and click Run Test. A 200 response with a body confirms the token is accepted. A 401 means the API rejected it — see below.

Advanced#

• Per-endpoint override — if one endpoint needs different credentials (or none), expand that endpoint’s Authentication Override accordion and enable the toggle. The override replaces the API-level auth for that endpoint only.
• Filter the token at request time — the huxx_connect/auth/token filter receives the token plus the API and endpoint context before the header is built, for rotation or per-request substitution schemes.

If it didn’t work#

• Response is 401 or 403. The API rejected the token. Check that you didn’t paste it with a Bearer prefix (HuxxConnect adds its own, so a pasted prefix sends Bearer Bearer ...), and confirm in the provider dashboard that the token is active and has the required scopes. Inspect the actual request in Debug API requests.
• The token field shows “Credentials could not be decrypted due to encryption key mismatch. Please re-enter your credentials.” The encryption key changed since the token was saved — common after moving or cloning a site. Re-enter the token and click Save API; to prevent a repeat, read Choose an encryption tier.
• One endpoint fails while others succeed. Check that endpoint’s Authentication Override accordion — an enabled override replaces the API-level token for that endpoint.