Auth Types
Configure auth on the Auth tab of a request.
| Type | What it does |
|---|---|
| Bearer Token | Sets Authorization: Bearer <token>. Token field supports {{variables}}. |
| Basic Auth | Sets Authorization: Basic <base64(username:password)>. |
| API Key | Adds a custom header (or query param) with a key/value you choose. |
| OAuth 2.0 — Client Credentials | Set Access Token URL, Client ID, Client Secret, and optionally Scope. Click Get Access Token to fetch and cache a token, or just hit Send — Volley fetches one automatically if none is cached (or the cached one has expired). |
| OAuth 2.0 — Password Grant | Same as above, plus Username/Password, sent with grant_type=password. |
| OAuth 2.0 — Authorization Code | Set Authorization URL, Access Token URL, Client ID, and (optionally, if not using PKCE) Client Secret. Click Get Access Token (or hit Send) to open the provider's login page in a popup; Volley's local server handles the /api/oauth/callback redirect, exchanges the code for a token (with PKCE by default), and caches it like the other OAuth2 grants. |
| Digest Auth | Set Username/Password. Volley sends the request, and if the server responds with a WWW-Authenticate: Digest challenge, transparently retries with the computed digest response — no manual nonce handling needed. |
| JWT Bearer (HS256) | Set a Secret and a JSON payload (e.g. {"sub":"user123"}). Volley signs a fresh HS256 JWT at send time, adding iat/exp (1 hour) automatically if you don't specify them, and sends it as Authorization: Bearer <jwt>. |
For OAuth2, the fetched token is cached on the request (cachedToken/cachedExpiry) and reused until it expires. The resulting Authorization: Bearer <token> header is shown read-only under "Auto-generated" on the Headers tab (uncheck it there to omit it from the request).