> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/configure-targets/configure-authentication/configure-bruno-collection-authentication.md).

# Configure Bruno Collection Authentication

Configure authentication to scan an API using a Bruno collection.

Configure Snyk API & Web to run authenticated requests that use dynamically generated tokens (through a script). If scans take longer and your token expires, configure Snyk API & Web to detect logout and generate a new token.

## Example scenario

This guide uses a Bruno Collection example with the following requests:

1. **Authenticate and obtain an authentication token:** Requires a username and password in the request body.
2. **Get a list of users:** Requires the authentication token in the request header.
3. **Get user details:** Requires the authentication token in the request header and the user identifier as a parameter.
4. **Check token:** Requires the authentication token in the request header to validate the token

For configuring 1, 2 and 3, follow the example in [Configure an API target with a Bruno Collection](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/configure-targets/configure-api-targets/configure-an-api-target-with-a-bruno-collection.md).

### Configure your Bruno collection for authentication

Create two top-level folders in your Bruno Collection, one for authentication and one for logout detection. Include test scripts to verify that authentication works and tokens remain valid:

1. Add the authentication request to the `auth` folder and validate that the test passed.<br>

   <figure><img src="/files/YveDAl3dOpi9VDiPVJrB" alt=""><figcaption></figcaption></figure>

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Snyk API &#x26; Web uses the result of this test to notify you that the login failed and instruct the scanner to run the logout detection request.</p></div>
2. Add the check token request to the `logout-detection` folder. Then navigate to the **Scripts** tab of the request and add the following test in the **Post Response** to validate that your token is still valid:<br>

   ```javascript
   test("Token is valid", function () {
   const data = res.getBody();
   expect(data.valid).to.be.true;
   });
   ```

   <figure><img src="/files/H1i6CMwDGrVtAXjPLtTS" alt=""><figcaption></figcaption></figure>

### Test and export the collection

After configuring all requests, run the collection to test it. If no issues occur, export the collection.

## Add or update your Bruno target

Add the Bruno target using the Bruno collection you exported. If your target is already configured in Snyk API & Web, update its schema:

1. Navigate to the **Targets** page.
2. Click the **gear icon** to access the target settings.
3. Select the **Scanner** tab and locate the **API SCANNING SETTINGS** section.
4. Upload the updated Bruno collection.
5. Save your changes and add the required environment variables.

## Configure Bruno target authentication

After configuring the Bruno environment values, configure your target's custom authentication:

1. Select the **Authentication** tab and locate the **API TARGET AUTHENTICATION** section.
2. Select the **AUTHENTICATION FOLDER**. After selection, the form updates to show the remaining fields.
3. Configure the authentication variables:
   1. **VARIABLE TYPE**: Select how the variable is scoped in your Bruno Collection. This must match how the variable is set in your collection's test script:
      * **Runtime**: For variables set with `bru.setVar()`
      * **Environment**: For variables set with `bru.setEnvVar()`
      * **Global**: For variables set with `bru.setGlobalEnvVar()`
   2. **VARIABLE NAME**: Select the name of the variable as defined in your test script (for example, `bearerToken`).
   3. **PLACE VARIABLE CONTENT IN**: Select where to send the variable content - **Header** or **Cookie**.
   4. **FIELD NAME**: Enter the name of the header or cookie field (for example, `Authorization`).
   5. **VALUE PREFIX**: Enter an optional prefix added before the variable value (for example, `Bearer`).
4. Click **Add Variable**. You can add multiple variables as needed.
5. Optionally, select the checkbox: **When login fails, fail the scan immediately and notify me**.
6. Click **Save** and ensure the authentication toggle is set to **On**.

## Configure Bruno logout detection (optional)

Adding logout detection helps Snyk API & Web to determine if the session ended, and try to authenticate again to proceed with the scan:

1. Locate the **LOGOUT DETECTION** section.
2. Select the folder from the schema file that contains the logout request. For our example scenario, you should select the `logout-detection` folder.

You turn authentication and logout detection on or off using the toggle buttons, or delete the configuration with the **Delete** button.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/configure-targets/configure-authentication/configure-bruno-collection-authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.