---
title: Authentication Types Reference
slug: authentication-types
type: reference
plugin: huxx-connect
summary: Field-level reference for the five authentication types — None, Bearer Token, API Key, Basic Auth, Custom (Hook) — plus constant and env credential-source syntax.
keywords: [authentication, bearer token, api key, basic auth, custom auth, credentials]
version_added: 1.2.5
version_updated: 1.2.5
level: advanced
related: [authenticate-with-a-bearer-token, authenticate-with-an-api-key, authenticate-with-basic-auth, store-credentials-outside-the-database, understanding-authentication]
---

Configuring auth for the first time? Start with
[Authenticate with a Bearer Token](/docs/connect/how-to/authenticate-with-a-bearer-token/).

## Type registry

```php
// src/Admin/AdminPage.php
AdminPage::get_auth_types(): array   // value => UI label, filterable
```

| Value | UI label | Provider (`src/Auth/Providers/`) | Effect on the request |
|---|---|---|---|
| `none` | None | `NoneAuth` | Request unchanged |
| `bearer` | Bearer Token | `BearerTokenAuth` | `Authorization: Bearer {token}` header |
| `api_key` | API Key | `ApiKeyAuth` | Key in a header or query parameter |
| `basic` | Basic Auth | `BasicAuth` | `Authorization: Basic base64(username:password)` header |
| `custom` | Custom (Hook) | `CustomAuth` | `huxx_connect/auth/custom` filter mutates URL, headers, query |

The dropdown list is filterable via `huxx_connect/auth/types` (Pro adds
OAuth 2.0 this way). Auth is set per API under **Auth Type**; an endpoint's
**Authentication Override** accordion replaces it for that endpoint only —
resolution order lives in `AuthManager::resolve()`
(`src/Auth/AuthManager.php`).

## Credential-source syntax

Every credential field accepts three value forms, resolved in
`AuthManager::resolve_references()`:

| Value form | Resolves to | Example |
|---|---|---|
| Literal string | Used as-is; stored encrypted | `hxc_example_token_123` |
| `ALL_CAPS` name matching `^[A-Z][A-Z0-9_]+$` | `constant( NAME )` when defined in `wp-config.php` | `MY_API_TOKEN` |
| `env:NAME` | `getenv( 'NAME' )` | `env:MY_API_TOKEN` |

Resolution applies to the config keys `token`, `api_key`, `key`, `password`,
`secret`, `client_id`, `client_secret`, and `username`. An `ALL_CAPS` value
whose constant is **not** defined is sent as the literal string — a common
cause of 401s after moving sites. See
[Store credentials outside the database](/docs/connect/how-to/store-credentials-outside-the-database/).

## None (`none`)

No configuration fields. The request passes through unmodified. Source:
`src/Auth/Providers/NoneAuth.php`.

## Bearer Token (`bearer`)

Source: `src/Auth/Providers/BearerTokenAuth.php`.

| Name | Type | Default | Since | Description |
|---|---|---|---|---|
| `token` | `string` | `''` | 0.1.0 | The token. UI field: **Token (or constant name)**. Filterable at request time via `huxx_connect/auth/token` (receives token, `Api`, `Endpoint`). |

Config:

```
token: hxc_example_token_123    // Replace with your real token.
```

Header sent with every request:

```
Authorization: Bearer hxc_example_token_123
```

The `Bearer ` prefix is added by the provider — never include it in the
field.

## API Key (`api_key`)

Source: `src/Auth/Providers/ApiKeyAuth.php`.

| Name | Type | Default | Since | Description |
|---|---|---|---|---|
| `api_key` | `string` | `''` | 0.1.0 | The key. UI field: **API Key**. Legacy alias `key` is also read. Filterable via `huxx_connect/auth/token`. |
| `header_name` | `string` | `X-API-Key` | 0.1.0 | Header name — or query parameter name when `location` is `query`. UI field: **Header Name** / **Parameter Name**. |
| `location` | `string` | `header` | 0.1.0 | `header` or `query`. UI field: **Location** (**Header** / **Query String**). |

Config (header placement):

```
location:    header
header_name: X-API-Key
api_key:     hxc_example_token_123    // Replace with your real token.
```

Header sent:

```
X-API-Key: hxc_example_token_123
```

With `location: query` and `header_name: api_key`, the key is appended to
the query string instead:

```
GET https://api.example.com/v1/reports?api_key=hxc_example_token_123
```

## Basic Auth (`basic`)

Source: `src/Auth/Providers/BasicAuth.php`.

| Name | Type | Default | Since | Description |
|---|---|---|---|---|
| `username` | `string` | `''` | 0.1.0 | UI field: **Username**. Accepts constant/`env:` references. |
| `password` | `string` | `''` | 0.1.0 | UI field: **Password**. Accepts constant/`env:` references. |

Config:

```
username: api_user
password: hxc_example_token_123    // Replace with your real token.
```

Header sent — `base64_encode( 'api_user:hxc_example_token_123' )`:

```
Authorization: Basic YXBpX3VzZXI6aHhjX2V4YW1wbGVfdG9rZW5fMTIz
```

Base64 is encoding, not encryption — Basic Auth is only as safe as the HTTPS
connection carrying it.

## Custom (Hook) (`custom`)

Source: `src/Auth/Providers/CustomAuth.php`. No fixed fields — the entire
auth config array is handed to your filter, and authentication is applied in
PHP:

```php
apply_filters( 'huxx_connect/auth/custom', array $request, array $config );
```

| Name | Type | Description |
|---|---|---|
| `$request` | `array` | Current request parts: `url`, `headers`, `query`. Return it modified. |
| `$config` | `array` | The API's (or endpoint override's) auth configuration array, with constant/`env:` references already resolved. |

Any of `url`, `headers`, `query` missing from the returned array falls back
to its original value.

```php
add_filter( 'huxx_connect/auth/custom', function ( array $request, array $config ) {
    $request['headers']['Authorization'] = 'Bearer hxc_example_token_123'; // Replace with your real token.
    return $request;
}, 10, 2 );
```

Header sent:

```
Authorization: Bearer hxc_example_token_123
```

An unknown auth type value falls back to `NoneAuth`
(`AuthManager::create_provider()` default case).

## Related filters

| Filter | Signature | Purpose |
|---|---|---|
| `huxx_connect/auth/types` | `( array $types )` | Add or remove entries in the Auth Type dropdown |
| `huxx_connect/auth/config` | `( array $auth_config, string $auth_type, Api $api, Endpoint $endpoint )` | Modify the resolved config before the provider is created |
| `huxx_connect/auth/provider` | `( AuthProviderInterface $provider, Api $api, Endpoint $endpoint, array $auth_config )` | Replace or decorate the resolved provider |
| `huxx_connect/auth/token` | `( string $token, ?Api $api, ?Endpoint $endpoint )` | Filter the Bearer token / API key value at request time |

## Internal type: `constant`

A sixth type, `constant` (`src/Auth/Providers/ConstantAuth.php`), exists for
programmatic configurations only — the admin UI does not offer it. Config
keys: `constant_name`, `header_name` (default `Authorization`), `prefix`
(e.g. `Bearer `). It sets `{header_name}: {prefix}{constant value}` when the
constant is defined, and adds no header otherwise. In the UI, use a constant
reference inside any credential field instead.