Where auth is set
Authentication can be configured at four levels. When a request is sent, Mariner walks up from the request until it finds a concrete setting:
- The request’s own Auth tab.
- The nearest folder with an override (folders → Edit Auth…).
- The collection (right-click → Edit Auth…).
- The workspace (menu Workspace → Edit Auth…).
New requests and collections are set to Inherit, so in practice you configure the collection once and forget about it. Choosing No Auth at any level stops the walk: that request goes out unauthenticated even if the workspace has a token.
Every text field in the auth editor accepts {{variables}}, so the token itself can live in the environment and change with it.
Types
- Basic — username and password, sent as an
Authorization: Basicheader. - Bearer Token — the token goes in
Authorization: Bearer …. - API Key — a name and a value, sent either as a header or as a query parameter.
- OAuth2 Client Credentials — token URL, client ID, client secret, optional scope and audience. Test fetch token requests one right there and shows the first characters so you know it worked. Tokens are cached and refreshed before they expire.
- OAuth2 Authorization Code — authorization URL, token URL, client ID, scope, redirect URI, with PKCE (S256) on by default. Authorize opens the provider’s login in a system web session; tick Private session to log in with a different account than Safari’s. Clear tokens forgets the session. The default redirect URI is
mariner://oauth/callback— register it with your provider.
Where credentials are stored
Passwords, tokens, API-key values, client secrets and OAuth token sets are written to the macOS Keychain, not to the workspace database.
- They do not sync through iCloud. Enter them once on each Mac.
- They are never exported with a collection.
- They are deleted when the request, folder, collection or workspace that owns them is deleted.