> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/2023-2/admin-essentials/integrations/auth/security-schemes/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Understand auth security schemes

> Supported security schemes for integration token management in Itential Platform, including API Key, AWS, HTTP, and OAuth2, with configuration examples for each.

After you create an integration, a *security scheme* authentication object is added to the service configuration properties.

## Supported security schemes

The following security schemes are supported:

* `apiKey` (including AWS)
* `https`
* `oauth2`
* `mutualTLS`
* `OpenIDConnectScheme`

## Considerations

* Tokens must be self-managed.
* For Amazon Web Services (AWS), ensure the `securityScheme` entry is an `apiKey` and has the following extension: `"x-amazon-apigateway-authtype": "awsSigv4"`.
* When you import an integration model, you can only a single security scheme is supported.
* The first scheme in the `securityScheme` map is automatically selected.

```json
"securitySchemes": {
  "Authorization": {
    "type": "apiKey",
    "description": "Amazon S3 signature",
    "name": "Authorization",
    "in": "header",
    "x-amazon-apigateway-authtype": "awsSigv4"
  }
}
```

### Example security schemes

Listed below are examples of each security scheme that can be used with Integration Models. The property names `API-Token` and `Authorization` in the API Key and AWS examples come from the name of the `securityScheme` property in the OpenAPI document.

#### API Key

```json
"authentication": {
  "API-Token": {
    "value": "<INSERT API-Token HERE>"
  }
}
```

#### AWS

```json
"authentication": {
  "Authorization": {
    "accessKeyId": "<INSERT accessKeyId HERE>",
    "secretAccessKey": "<INSERT secretAccessKey HERE>"
  }
}
```

#### AWS Lambda

Certain AWS endpoints (i.e., AWS Sig4) may need a configured `sessionToken`. Itential Platform includes support for [AWS Lambda](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html), a custom extension to OpenAPI that requires a key/secret and a session token.

```json
"authentication": {
  "Authorization": {
    "accessKeyId": "awsKeys.accessKeyId",
    "secretAccessKey": "awsKeys.secretAccessKey",
    "sessionToken": "awsKeys.sessionToken"
  }
}
```

#### HTTP (Basic and Bearer)

**Basic:**

```json
"authentication": {
  "httpBasic": {
    "username": "<INSERT username HERE>",
    "password": "<INSERT password HERE>"
  }
}
```

**Bearer:**

```json
"authentication": {
  "bearerAuth": "<INSERT bearerAuth HERE>"
}
```

#### OAuth2

```json
"authentication": {
  "oauth2": {
    "token": {
      "access_token": "<INSERT access_token HERE>",
      "token_type": "Bearer"
    }
  }
}
```

> Supported security schemes for integration token management in Itential Platform, including API Key, AWS, HTTP, and OAuth2, with configuration examples for each.