Bearer tokens and other Authorization headers for your target

Until now the only way to secure your inbound HTTP target was basic authentication, set by adding a username and password to the target URL itself. That worked, but it meant your credentials lived in the URL, and it ruled out every other kind of authentication.

You can now set the Authorization header we send with each POST directly. Any value works, so a Bearer token, an API key, or basic auth are all just a matter of typing the header you want:

Authorization: Bearer my-token

The setting has its own page. Open an address, choose Authorization Settings, and enter the header. If you want basic auth and would rather not work out the encoding yourself, there's a small tool on the page that takes a username and password and builds the header for you, in your browser.

Existing addresses have been moved across for you. Any credentials that were in a target URL are now stored as an Authorization header instead, and the header we send is unchanged, so your endpoint sees exactly what it saw before. The URLs themselves no longer carry the username and password, which keeps them out of logs and referrer headers.

One thing to note: setting credentials in the target URL is no longer accepted, so if you need to change them, set the header on the Authorization Settings page for your address.

See our securing your target documentation for more on protecting your endpoint.