> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deploybaseline.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How every emulator accepts credentials, and the credential each provider's SDK sends.

Every emulator takes the credential its vendor's SDK already sends: a bearer token, an API key, HTTP Basic, a signed request, or an OAuth access token from the emulator's own sign-in flow. Your SDK keeps its auth code. Only the base URL changes.

## Tokens from the config file

The top-level `tokens` map is shared by every service. Each token names a user, and providers that check scopes read them from here:

```json theme={null}
{
  "tokens": {
    "gho_test_token_admin": {
      "login": "admin",
      "scopes": ["repo", "user", "admin:org", "admin:repo_hook"]
    },
    "gho_test_token_user1": {
      "login": "octocat",
      "scopes": ["repo", "user"]
    }
  }
}
```

With no `tokens` in the config, the CLI seeds `test_token_admin` (login `admin`). Send a token as `Authorization: Bearer <token>` or `Authorization: token <token>`, unless the provider's SDK uses another header (the table below lists those).

## Any token works from the CLI

When the CLI starts a service, a non-empty token it does not know acts as that service's default user, so a placeholder such as `sk_test_baseline` or `xoxb-local` works with no setup. Credentials the emulator issued itself (OAuth access tokens, API keys created through the API, seeded keys with scopes) are checked the way the vendor checks them: a revoked, expired, or under-scoped one is refused with the vendor's error.

To make a provider strict, seed its own credentials (for example Square's `tokens[]` with `scopes`, HubSpot's `private_apps`, or SendGrid's `api_keys`). Some providers also take `strict_scopes: true` (Google, Slack, Linear). Each provider's page lists its options.

## OAuth and OIDC

Providers with a sign-in flow serve it locally: the authorization page with a user picker, the token endpoint, and, for OIDC providers, `/.well-known/openid-configuration` and a JWKS. Register OAuth clients in the provider's seed config for strict `client_id`, secret, and redirect URI checks. ID tokens are signed with a key generated per run unless you pin one; see [OIDC signing keys](/configuration.md#oidc-signing-keys).

## By provider

| Provider | What the SDK sends | Details |
| - | - | - |
| Auth0 | Universal Login and the token endpoint; Management API access tokens | [Auth0](/auth0.md#token-endpoint) |
| Clerk | `Authorization: Bearer <secret key>` on the Backend API | [Clerk](/clerk.md#auth) |
| Okta | `Authorization: SSWS <token>`, or OAuth access tokens with `okta.*` scopes | [Okta](/okta.md#auth) |
| Apple | Sign in with Apple: a signed client secret JWT and the authorization code flow | [Apple](/apple.md#authorization-flow) |
| Google | OAuth 2.0 access tokens; `strict_scopes` checks method scopes | [Google](/google.md#auth) |
| Microsoft | Entra ID access tokens (delegated `scp` or application `roles`) | [Microsoft](/microsoft.md#auth) |
| Notion | Internal integration tokens or OAuth access tokens | [Notion](/notion.md#auth) |
| Slack | `Authorization: Bearer` bot and user tokens; `strict_scopes` checks scopes | [Slack](/slack.md#auth) |
| Discord | `Authorization: Bot <token>`, or OAuth2 bearer tokens with scopes | [Discord](/discord.md#auth) |
| Twilio | HTTP Basic: Account SID and Auth Token, or API Key SID and secret | [Twilio](/twilio.md#auth) |
| WhatsApp | `Authorization: Bearer` system user tokens, or the app token | [WhatsApp](/whatsapp.md#auth) |
| Resend | `Authorization: Bearer` API keys, with `sending_access` limits | [Resend](/resend.md#auth) |
| SendGrid | `Authorization: Bearer` API keys with scopes | [SendGrid](/sendgrid.md#auth) |
| Stripe | `Authorization: Bearer sk_test_...` secret keys | [Stripe](/stripe.md#start) |
| PayPal | Client credentials at `/v1/oauth2/token`, then the bearer token | [PayPal](/paypal.md#auth) |
| Square | Personal access tokens or OAuth access tokens with scopes | [Square](/square.md#auth) |
| Plaid | `client_id` and `secret` in the body or headers | [Plaid](/plaid.md#auth) |
| Shopify | `X-Shopify-Access-Token` app tokens with scopes | [Shopify](/shopify.md#auth) |
| GitHub | Personal tokens, OAuth App tokens, GitHub App JWTs and installation tokens | [GitHub](/github.md#auth) |
| Linear | `Authorization: Bearer` or a bare personal API key; OAuth | [Linear](/linear.md#auth) |
| Jira | Basic with email and API token, OAuth 2.0 (3LO), or bearer tokens | [Jira](/jira.md#auth) |
| Salesforce | `Authorization: Bearer` session IDs and OAuth access tokens | [Salesforce](/salesforce.md#auth) |
| HubSpot | Private app tokens or OAuth access tokens with scopes | [HubSpot](/hubspot.md#auth) |
| Zendesk | Basic with an API token or password, or OAuth bearer tokens | [Zendesk](/zendesk.md#auth) |
| ServiceNow | Basic with a user name and password, or OAuth bearer tokens | [ServiceNow](/servicenow.md#auth) |
| NetSuite | Token-based authentication (OAuth 1.0 HMAC-SHA256), or OAuth 2.0 | [NetSuite](/netsuite.md#auth) |
| QuickBooks | OAuth access tokens scoped to one company | [QuickBooks](/quickbooks.md#auth) |
| Xero | OAuth access tokens plus the `xero-tenant-id` header | [Xero](/xero.md#auth) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.