When I add security Scheme as JWT in my OpenAPI definition, the "Try it out" feature in UI always returns 401: Unauthorized error

Question

I have the following basic openAPI definition:

openapi: "3.0.0"

info:
  description: >-
    API which tests service
  version: "1.0"
  title: Test Service

servers:
  - url: /
    description: Localhost Server

security:
  - bearerAuth: []

paths:
  /test:
    get:
      operationId: app.test
      responses:
        200:
          description: Test
          content:
            text/plain:
              schema:
                type: string

components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

The Swagger UI shows "Authorize" option where I put the JWT token without "Bearer" keyword, and click on "Try it out". The response is:

{
  "detail": "No authorization token provided",
  "status": 401,
  "title": "Unauthorized",
  "type": "about:blank"
}

The curl command has the correct Authorization header, which also doesn't work if I execute it in a terminal.

However, if I remove the security tag from the OpenAPI definition, the "Try it out" as well as the curl command works.

Does anyone know what could be the problem? What is the correct curl command when using JWT security Scheme in OpenAPI?

bruce szalwinski bruce szalwinski · Accepted Answer · 2020-03-25T17:54:01

I'm using JWT authentication in my app and this is my curl that works. I'm trying to figure out how to get OpenApi to generate the proper headers.

curl "${URL}/${ID}/${RESOURCE}" \
    -H "Accept: application/json" \
    -H "X-Requested-With: XMLHttpRequest" \
    -H "Authorization: Bearer ${BEARER_TOKEN}" \
    -H "Content-Type: application/json" | python -m json.tool

When I add security Scheme as JWT in my OpenAPI definition, the "Try it out" feature in UI always returns 401: Unauthorized error

1 Answers