Skip to main content
LiteClient provides built-in authentication support for the most common API authentication methods. Configure authentication in the Auth tab, and LiteClient automatically applies the necessary headers and credentials.

​
API Key Authentication

API Key authentication lets you send a custom header or query parameter with your API key.
Configure API key in a custom header:
1

Select API Key

In the Auth tab, select API Key from the type dropdown.
2

Choose Placement

Select Header as the placement location.
3

Configure Key and Value

  • Key: X-API-Key (or your API’s header name)
  • Value: {{apiKey}} (use a variable for security)
Example configuration:
Placement: Header
Key: X-API-Key
Value: {{apiKey}}
This sends: X-API-Key: your-api-key-here
Store API keys in environment variables and mark them as secret type to mask them in the UI. Never hardcode API keys in requests.

​
Bearer Token Authentication

Bearer Token authentication is commonly used for JWT-based APIs and OAuth 2.0 access tokens.
1

Select Bearer Token

In the Auth tab, select Bearer Token from the type dropdown.
2

Enter Token

Enter your token value. Use a variable like {{accessToken}} for flexibility.
3

Send Request

LiteClient automatically adds the Authorization: Bearer <token> header.
Example configuration: 
Type: Bearer Token
Token: {{accessToken}}
Generated header: 
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Bearer tokens support variable substitution. Store tokens in environment variables so you can use different tokens for local, staging, and production.

​
Basic Authentication

Basic Auth sends username and password credentials encoded in Base64.
1

Select Basic Auth

In the Auth tab, select Basic Auth from the type dropdown.
2

Enter Credentials

  • Username: Your username or {{username}} variable
  • Password: Your password or {{password}} variable
3

Automatic Encoding

LiteClient automatically encodes credentials in Base64 and adds the Authorization header.
Example configuration: 
Type: Basic Auth
Username: {{apiUsername}}
Password: {{apiPassword}}
Generated header: 
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
Basic Auth sends credentials with every request. Always use HTTPS to prevent credentials from being intercepted. Consider using environment variables for credentials.

​
OAuth 2.0 Authentication

LiteClient provides comprehensive OAuth 2.0 support with three grant types and automatic token management.

​
Authorization Code Flow

Traditional OAuth 2.0 flow with browser-based authentication.
1

Select OAuth 2.0

In the Auth tab, select OAuth 2.0 from the type dropdown.
2

Choose Grant Type

Select Authorization Code as the grant type.
3

Configure Endpoints

  • Authorization URL: The provider’s authorization endpoint
  • Token URL: The provider’s token endpoint
  • Client ID: Your application’s client ID
  • Client Secret: Your application’s client secret (if required)
  • Redirect URI: vscode://liteclienthq.liteclient/oauth2/callback
  • Scope: Space-separated scopes (e.g., read write)
4

Get Token

Click Get Token to open the authorization page in your browser.
5

Authorize

Log in and authorize the application. LiteClient receives the callback and exchanges the code for an access token.
6

Automatic Token Usage

The token is cached in VS Code’s secure storage and automatically added to requests.
Example configuration: 
Grant Type: Authorization Code
Auth URL: https://provider.com/oauth/authorize
Token URL: https://provider.com/oauth/token
Client ID: {{clientId}}
Client Secret: {{clientSecret}}
Redirect URI: vscode://liteclienthq.liteclient/oauth2/callback
Scope: read write admin

​
Authorization Code with PKCE

Enhanced security flow for public clients (recommended for most use cases).
1

Select PKCE Grant Type

In the Auth tab, select Authorization Code with PKCE as the grant type.
2

Configure Endpoints

Same configuration as Authorization Code, but Client Secret is optional.
3

Get Token

Click Get Token. LiteClient generates a code verifier and challenge automatically.
4

Enhanced Security

PKCE protects against authorization code interception attacks.
PKCE (Proof Key for Code Exchange) is more secure than standard Authorization Code flow and doesn’t require a client secret. Use PKCE when available.

​
Client Credentials Flow

Machine-to-machine authentication without user interaction.
1

Select Client Credentials

In the Auth tab, select Client Credentials as the grant type.
2

Configure Credentials

  • Token URL: The provider’s token endpoint
  • Client ID: Your application’s client ID
  • Client Secret: Your application’s client secret
  • Scope: Optional scopes
  • Audience: Optional audience parameter
3

Get Token

Click Get Token. LiteClient requests a token directly from the token endpoint.
4

Use for Server-to-Server

Ideal for backend services, scheduled tasks, and server-to-server communication.
Example configuration: 
Grant Type: Client Credentials
Token URL: https://provider.com/oauth/token
Client ID: {{serviceClientId}}
Client Secret: {{serviceClientSecret}}
Scope: api.read api.write
Audience: https://api.example.com
Use environment variables for Client ID and Client Secret to support different OAuth apps across local, staging, and production.

​
Token Caching and Refresh

LiteClient automatically manages OAuth 2.0 tokens:
  • Secure Storage: Tokens are stored in VS Code’s SecretStorage (encrypted)
  • Automatic Caching: Tokens are reused across requests until expiration
  • Auto Refresh: When tokens expire, LiteClient automatically requests a new token using the refresh token (if available)
  • Per-Configuration: Each OAuth 2.0 configuration maintains its own token cache
Token refresh happens automatically when you send a request with an expired token. You don’t need to manually refresh tokens.

​
Using Variables in Authentication

All authentication types support variable substitution: 
API Key: {{apiKey}}
Bearer Token: {{accessToken}}
Username: {{username}}
Password: {{password}}
Client ID: {{oauthClientId}}
Client Secret: {{oauthClientSecret}}
This lets you:
  • Use different credentials per environment
  • Avoid hardcoding secrets in requests
  • Share collections without exposing credentials

​
Best Practices

Store all API keys, tokens, usernames, and passwords in environment variables. Mark them as secret type to mask them in the UI.
When the API supports it, prefer Authorization Code with PKCE over standard Authorization Code for better security.
Create separate environments for local, staging, and production with different API keys and OAuth credentials for each.
Use current values for local testing instead of initial values. Current values are never committed to Git.
For server-to-server API calls, use Client Credentials flow instead of Authorization Code to avoid interactive login.