Restheart Authentication

generated: '2026-10-21'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://restheart.org/docs/security/authentication/overview
sources:
- https://restheart.org/docs/security/authentication/overview
- https://restheart.org/docs/security/authentication/jwt
- https://restheart.org/docs/security/authentication/cookie
- https://restheart.org/docs/security/authentication/api-key
description: Authentication mechanisms supported by RESTHeart
schemes:
- type: http-bearer
  name: JWT
  evidence: JwtAuthenticationMechanism reads a Bearer token.
  location: header
  header: Authorization
  how_to_obtain: 'Obtain a JWT from the /token endpoint (or other login endpoints) and include it in the Authorization: Bearer <jwt> header.'
- type: http-bearer
  name: API Key
  evidence: apiKeyAuthMechanism reads the header and extracts the key.
  location: header
  header: Authorization
  how_to_obtain: 'Create a key via the API (or admin UI) and send it as Authorization: Bearer rhak_<key>.'
- type: http-basic
  name: Basic
  evidence: 'basicAuthMechanism reads the Authorization: Basic header.'
  location: header
  header: Authorization
  how_to_obtain: 'Send username and password encoded in Base64 in the Authorization: Basic <credentials> header.'
- type: other
  name: Cookie
  evidence: Cookie Authentication allows the client browser to store an authentication token in a secure cookie.
  location: cookie
  how_to_obtain: Authenticate via Basic (or another method) to receive a Set-Cookie response (rh_auth) and then include that cookie on subsequent
    requests.
docs: https://restheart.org/docs/security/authentication/overview