# Authentication

> Basic, Bearer, API key and both common OAuth 2.0 flows, set once at the workspace, collection or folder and inherited by everything below. Credentials live in the macOS Keychain.

## Where auth is set

Authentication can be configured at four levels. When a request is sent, Mariner walks up from the request until it finds a concrete setting:

1. The request's own **Auth** tab.
2. The nearest **folder** with an override (folders → *Edit Auth…*).
3. The **collection** (right-click → *Edit Auth…*).
4. The **workspace** (menu **Workspace → Edit Auth…**).

New requests and collections are set to **Inherit**, so in practice you configure the collection once and forget about it. Choosing **No Auth** at any level stops the walk: that request goes out unauthenticated even if the workspace has a token.

Every text field in the auth editor accepts `{{variables}}`, so the token itself can live in the environment and change with it.

## Types

- **Basic** — username and password, sent as an `Authorization: Basic` header.
- **Bearer Token** — the token goes in `Authorization: Bearer …`.
- **API Key** — a name and a value, sent either as a **header** or as a **query parameter**.
- **OAuth2 Client Credentials** — token URL, client ID, client secret, optional scope and audience. **Test fetch token** requests one right there and shows the first characters so you know it worked. Tokens are cached and refreshed before they expire.
- **OAuth2 Authorization Code** — authorization URL, token URL, client ID, scope, redirect URI, with **PKCE (S256)** on by default. **Authorize** opens the provider's login in a system web session; tick **Private session** to log in with a different account than Safari's. **Clear tokens** forgets the session. The default redirect URI is `mariner://oauth/callback` — register it with your provider.

## Where credentials are stored

Passwords, tokens, API-key values, client secrets and OAuth token sets are written to the **macOS Keychain**, not to the workspace database.

- They **do not sync** through iCloud. Enter them once on each Mac.
- They are **never exported** with a collection.
- They are deleted when the request, folder, collection or workspace that owns them is deleted.

<aside class="callout" data-label="VARIABLES VS CREDENTIALS">
A token stored as an environment variable is masked and excluded from exports, but it does sync with iCloud as part of the environment. A token entered in the Auth tab stays on this Mac. Pick the one that matches how you want to share the collection.
</aside>

---
Source: https://marinerhttp.dev/docs/auth · Mariner docs