auth

Every request has an Auth tab. Pick a scheme from the Type dropdown and fill in the fields. Auth set on a folder or the collection is inherited by descendants whose own type is Inherit from parent; the Inherit panel shows what would actually be applied.

All credential fields run through {{variable}} resolution at send time, so you can store a token as {{TOKEN}} and keep the value in an environment variable.

Secrets stay out of your YAML

Password / token / secret-key fields are not written into the git-tracked collection YAML. On save they are externalized to a per-collection store under your OS config dir (or $HELENA_SECRETS_DIR) and merged back on load — so you can version-control a collection without committing cleartext credentials.

A request header you set yourself always wins over an auth-derived header, so manual escape hatches keep working.

None / Inherit#

None sends no credentials. Inherit from parent walks up the folder → collection chain and applies the nearest configured auth.

Auth on a folder or the collection#

Set auth once, high up, and let requests inherit it:

• Folder — select the folder in the sidebar and click the Folder settings button (the folder-tree icon). The dialog's Auth tab has the same Type dropdown and fields as a request's Auth tab. Its Inherit from parent panel shows what the folder itself would inherit from the enclosing folders or the collection.
• Collection — click the Collection settings button (the sliders icon). Its Auth tab configures the collection root. There is no Inherit option here: the root has no parent, so an unset root means None.

Both dialogs pair the Variables and Auth tabs and save them together. New requests default to Inherit from parent, so everything under a folder picks up the folder's auth with no further clicks; a request that needs something different sets its own Type (or None to send no credentials at all). Folder and collection auth live in folder.yml / opencollection.yml, with secrets externalized exactly like request auth.

Basic Auth#

Username + password, sent as Authorization: Basic base64(user:pass).

Bearer Token#

A token sent as Authorization: Bearer <token>. Commonly {{TOKEN}} populated by a login request's post-response script (see Scripting).

API Key#

A name/value pair placed either in a header or the query string.

OAuth 2.0#

Helena fetches and caches tokens for you. Two grants are supported:

• Client Credentials — server-to-server. Fill the token URL, client id, and client secret (plus optional scope / audience).
• Authorization Code — opens your browser, runs the redirect on an ephemeral localhost listener, verifies the CSRF state, and exchanges the code. Tick Use PKCE for the SHA-256 challenge.

Tokens are cached per collection + config and reused until just before expiry. Clear cached tokens drops them for the active collection.

OAuth 1.0a#

Two- or three-legged OAuth 1.0a with HMAC-SHA1 request signing (RFC 5849). Fill the consumer key/secret and optional token/token-secret; each send computes a signature over the request and emits an Authorization: OAuth … header.

WS-Security (WSSE)#

WS-Security UsernameToken. Each send generates a fresh nonce + timestamp and emits an X-WSSE header whose PasswordDigest is Base64(SHA1(nonce + created + password)).

AWS Signature v4#

Signs the request with AWS4-HMAC-SHA256. Fill the access key id, secret access key, region, and service (a session token is optional, for temporary STS credentials). Helena builds the canonical request, derives the signing key, and emits the Authorization + X-Amz-Date headers (and X-Amz-Security-Token when a session token is set).

HTTP Digest#

Challenge/response digest auth (RFC 7616). Helena sends the request unauthenticated, reads the server's WWW-Authenticate: Digest challenge, and retries with the computed response (MD5 or SHA-256, qop=auth). Just fill the username + password.

NTLM#

NTLMv2, the multi-round Windows scheme: Helena runs the NEGOTIATE → CHALLENGE → AUTHENTICATE handshake over a single keep-alive connection. Fill the username + password and optional domain / workstation.

Lean dependencies

The crypto these schemes need that Go's standard library omits — notably MD4 for NTLM — is implemented from the spec inside Helena rather than pulled in as a third-party dependency, and pinned to the published test vectors (RFC 1320, MS-NLMP, RFC 5849, RFC 7616, the AWS SigV4 suite).