Assertible Authentication

generated: '2026-09-04'
method: searched
source: https://assertible.com/docs/guide/deployments
docs:
- https://assertible.com/docs/guide/deployments
- https://assertible.com/docs/guide/automation#trigger-url-parameters
- https://assertible.com/docs/guide/sync
summary:
  types:
  - http
  model: >-
    Every documented Assertible API call authenticates with HTTP Basic, where the
    username is an Assertible-issued token and the password is left empty. There
    is no OAuth, no OpenID Connect and no signed-request scheme on Assertible's
    own API. The trigger URL surface additionally accepts the token as an
    `api_token` query parameter for callers (such as Heroku deploy hooks) that
    cannot set a request body or an Authorization header.
  token_delivery:
  - HTTP Basic (token as username, empty password)
  - api_token query parameter (trigger URLs only)
  observed_401:
    probed: '2026-09-04'
    request: POST https://assertible.com/deployments (no credentials)
    http_status: 401
    body: '{"code":"AuthenticationError","message":"Not logged in"}'
schemes:
- name: basicAuth
  type: http
  scheme: basic
  description: |-
    HTTP Basic auth where the username is the Assertible API token
    (`ASSERTIBLE_API_TOKEN`) and the password is left empty.
  applies_to:
  - POST /deployments
  - POST /apis/{serviceId}/run
  sources:
  - openapi/assertible-deployments-api-openapi.yml
  - openapi/assertible-triggers-api-openapi.yml
  - https://assertible.com/docs/guide/deployments
- name: syncToken
  type: http
  scheme: basic
  description: |-
    HTTP Basic auth where the username is the Assertible sync token
    (`ASSERTIBLE_SYNC_TOKEN`) and the password is left empty. Documented
    separately from the deployments API token in Assertible's sync guide.
  applies_to:
  - POST /imports/{importId}/sync
  sources:
  - openapi/assertible-sync-api-openapi.yml
  - https://assertible.com/docs/guide/sync
- name: apiTokenQuery
  type: apiKey
  in: query
  key_name: api_token
  description: |-
    The API access token supplied as a query-string parameter. Documented in the
    Trigger URL Parameters table for callers that cannot send a body or header,
    for example a Heroku deploy hook URL.
  applies_to:
  - POST /apis/{serviceId}/run
  caution: >-
    A token in a query string is logged by intermediaries. Prefer HTTP Basic
    where the caller controls the request.
  sources:
  - https://assertible.com/docs/guide/automation#trigger-url-parameters
notes:
- >-
  DO NOT confuse https://assertible.com/docs/guide/auth with Assertible's own API
  authentication. That page documents the auth types (Basic, Digest, API token,
  OAuth 1.0a, OAuth 2.0, session/cookie, auth HTTP step) that Assertible can use
  when calling YOUR web service under test. It says nothing about authenticating
  to Assertible. The pipeline's earlier apis.yml Authentication pointer targeted
  https://assertible.com/docs/guide/authentication, which returns 404.
- >-
  Assertible offers encrypted variables for storing tokens, usernames and
  passwords used by tests. Source https://assertible.com/docs/guide/auth