APIs & HTTP
HTTP environments, secrets and authentication
Separate environments and secrets, reuse variables and configure authentication and chained requests.
In this guide
One worksheet, different environmentsChoose the authentication levelChain requests and checksOne worksheet, different environments#
Initial environments are Development, Test and Production. Public variables are retained only when Save environments is chosen. Session variables and Secrets JSON stay in memory; a secret written directly in a .http file is saved with that file.
- Define {{baseUrl}} in the public environment and tokens or passwords in session secrets.
- Check the selected environment and resolved values before sending.
- Use Clear secrets to remove values from the session.
Choose the authentication level#
A request can use no authentication, Bearer, Basic, an API key or inherited folder and collection settings. OAuth2 PKCE uses a local callback and requires correct provider configuration. Windows credential storage is an explicit choice.
Requests do not inherit browser cookies or credentials. Redirects to another origin remove credentials, and HTTPS-to-HTTP downgrade redirects are rejected. For a 401, check the environment, variables, expiry and service permissions.
Chain requests and checks#
In .http worksheets, @expect-status and @expect-json check responses, while @extract makes a value available to later steps. Run flow stops at the first failed request or check. Extractions stay in memory for that flow and do not execute arbitrary scripts.
### Profile
# @expect-status 200
# @expect-json $.active true
GET {{baseUrl}}/profile
Authorization: Bearer {{token}}