Configuring auth for the first time? Start with Authenticate with a Bearer Token.
Type registry
// src/Admin/AdminPage.php
AdminPage::get_auth_types(): array // value => UI label, filterable
| Value | UI label | Provider (src/Auth/Providers/) | Effect on the request |
|---|---|---|---|
none | None | NoneAuth | Request unchanged |
bearer | Bearer Token | BearerTokenAuth | Authorization: Bearer {token} header |
api_key | API Key | ApiKeyAuth | Key in a header or query parameter |
basic | Basic Auth | BasicAuth | Authorization: Basic base64(username:password) header |
custom | Custom (Hook) | CustomAuth | huxx_connect/auth/custom filter mutates URL, headers, query |
The dropdown list is filterable via huxx_connect/auth/types (Pro adds
OAuth 2.0 this way). Auth is set per API under Auth Type; an endpoint’s
Authentication Override accordion replaces it for that endpoint only —
resolution order lives in AuthManager::resolve()
(src/Auth/AuthManager.php).
Credential-source syntax
Every credential field accepts three value forms, resolved in
AuthManager::resolve_references():
| Value form | Resolves to | Example |
|---|---|---|
| Literal string | Used as-is; stored encrypted | hxc_example_token_123 |
ALL_CAPS name matching ^[A-Z][A-Z0-9_]+$ | constant( NAME ) when defined in wp-config.php | MY_API_TOKEN |
env:NAME | getenv( 'NAME' ) | env:MY_API_TOKEN |
Resolution applies to the config keys token, api_key, key, password,
secret, client_id, client_secret, and username. An ALL_CAPS value
whose constant is not defined is sent as the literal string — a common
cause of 401s after moving sites. See
Store credentials outside the database.
None (none)
No configuration fields. The request passes through unmodified. Source:
src/Auth/Providers/NoneAuth.php.
Bearer Token (bearer)
Source: src/Auth/Providers/BearerTokenAuth.php.
| Name | Type | Default | Since | Description |
|---|---|---|---|---|
token | string | '' | 0.1.0 | The token. UI field: Token (or constant name). Filterable at request time via huxx_connect/auth/token (receives token, Api, Endpoint). |
Config:
token: hxc_example_token_123 // Replace with your real token.
Header sent with every request:
Authorization: Bearer hxc_example_token_123
The Bearer prefix is added by the provider — never include it in the
field.
API Key (api_key)
Source: src/Auth/Providers/ApiKeyAuth.php.
| Name | Type | Default | Since | Description |
|---|---|---|---|---|
api_key | string | '' | 0.1.0 | The key. UI field: API Key. Legacy alias key is also read. Filterable via huxx_connect/auth/token. |
header_name | string | X-API-Key | 0.1.0 | Header name — or query parameter name when location is query. UI field: Header Name / Parameter Name. |
location | string | header | 0.1.0 | header or query. UI field: Location (Header / Query String). |
Config (header placement):
location: header
header_name: X-API-Key
api_key: hxc_example_token_123 // Replace with your real token.
Header sent:
X-API-Key: hxc_example_token_123
With location: query and header_name: api_key, the key is appended to
the query string instead:
GET https://api.example.com/v1/reports?api_key=hxc_example_token_123
Basic Auth (basic)
Source: src/Auth/Providers/BasicAuth.php.
| Name | Type | Default | Since | Description |
|---|---|---|---|---|
username | string | '' | 0.1.0 | UI field: Username. Accepts constant/env: references. |
password | string | '' | 0.1.0 | UI field: Password. Accepts constant/env: references. |
Config:
username: api_user
password: hxc_example_token_123 // Replace with your real token.
Header sent — base64_encode( 'api_user:hxc_example_token_123' ):
Authorization: Basic YXBpX3VzZXI6aHhjX2V4YW1wbGVfdG9rZW5fMTIz
Base64 is encoding, not encryption — Basic Auth is only as safe as the HTTPS connection carrying it.
Custom (Hook) (custom)
Source: src/Auth/Providers/CustomAuth.php. No fixed fields — the entire
auth config array is handed to your filter, and authentication is applied in
PHP:
apply_filters( 'huxx_connect/auth/custom', array $request, array $config );
| Name | Type | Description |
|---|---|---|
$request | array | Current request parts: url, headers, query. Return it modified. |
$config | array | The API’s (or endpoint override’s) auth configuration array, with constant/env: references already resolved. |
Any of url, headers, query missing from the returned array falls back
to its original value.
add_filter( 'huxx_connect/auth/custom', function ( array $request, array $config ) {
$request['headers']['Authorization'] = 'Bearer hxc_example_token_123'; // Replace with your real token.
return $request;
}, 10, 2 );
Header sent:
Authorization: Bearer hxc_example_token_123
An unknown auth type value falls back to NoneAuth
(AuthManager::create_provider() default case).
Related filters
| Filter | Signature | Purpose |
|---|---|---|
huxx_connect/auth/types | ( array $types ) | Add or remove entries in the Auth Type dropdown |
huxx_connect/auth/config | ( array $auth_config, string $auth_type, Api $api, Endpoint $endpoint ) | Modify the resolved config before the provider is created |
huxx_connect/auth/provider | ( AuthProviderInterface $provider, Api $api, Endpoint $endpoint, array $auth_config ) | Replace or decorate the resolved provider |
huxx_connect/auth/token | ( string $token, ?Api $api, ?Endpoint $endpoint ) | Filter the Bearer token / API key value at request time |
Internal type: constant
A sixth type, constant (src/Auth/Providers/ConstantAuth.php), exists for
programmatic configurations only — the admin UI does not offer it. Config
keys: constant_name, header_name (default Authorization), prefix
(e.g. Bearer ). It sets {header_name}: {prefix}{constant value} when the
constant is defined, and adds no header otherwise. In the UI, use a constant
reference inside any credential field instead.