Authentication method types

Ecosystem provides four authentication method types: Basic Auth, OAuth 2, API Key and Custom. The type determines the configuration fields and what Ecosystem applies automatically during an execution.

Basic Auth

Stores a username and a password. Ecosystem automatically adds the Authorization: Basic xxx header.

Parameter	Type	Required	Default	Description
Username	String	✅	—	Sign-in identifier required by the service.
Password	String (masked)	✅	—	Password, or reference to a dictionary variable.

OAuth 2

Stores OAuth 2 information. Ecosystem acquires the token and refreshes it automatically when it expires.

Parameter	Type	Required	Default	Description
Client ID	String	✅	—	OAuth client ID.
Client Secret	String (masked)	✅	—	OAuth client secret, or reference to a dictionary variable.
Token URL	URL	✅	—	URL used to obtain the token.
Scope	List	❌	—	Requested OAuth scopes, one per field.

Scope transmission

Each scope entered is transmitted when requesting a token. An empty field is ignored. If no scopes are entered, the scope parameter is not included in the request.

API Key

Stores an API key transmitted via HTTP headers and/or query parameters. Ecosystem automatically injects these values when the method is selected in an HTTP Request, Agent or Code node.

Parameter	Type	Required	Default	Description
Headers	Key-value pairs	❌	—	Headers to inject (e.g. x-api-key → {{dictionaries.secrets.apiKey}}).
Query params	Key-value pairs	❌	—	Parameters added to the URL (e.g. api_key → my_key).

In a Code node, access the values via libs.ecosystemCredentials.get('alias').getHeaders() or .getQueryParams().

Custom

Executes custom code that manages a token and its expiration date. Useful when the authentication server does not use a standard supported by Ecosystem.

Parameter	Type	Required	Default	Description
Token location	Header, Params or Cookie	✅	—	Where the token is placed on the request.
Name	String	✅	—	Name of the header, parameter or cookie (e.g. Authorization).
Value	String	✅	—	Injected value (e.g. Bearer {{accessToken}}).
Code	JavaScript	✅	—	Script returning { accessToken, expiresIn }.

Code output format

The code must return an object containing accessToken and expiresIn:

• accessToken: the authentication token used for the request;
• expiresIn: the token validity duration, in seconds.

{
  "accessToken": "__token_value__",
  "expiresIn": 300
}

Code example

The code can use all the features of a Code node (dictionaries, libs.axios, etc.).

// Generate the Basic Auth from the dictionaries
const basicHeader = Buffer.from(`${dictionaries.oauth.clientId}:${dictionaries.oauth.clientSecret}`).toString('base64');

// Call the token endpoint to obtain access_token
const { data: response } = await libs.axios.post('https://auth.api.com/oauth/token', {
  grant_type: 'client_credentials'
}, {
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    Authorization: `Basic ${basicHeader}`
  }
});

// Return the token and the validity duration
return {
  accessToken: response.access_token,
  expiresIn: response.expires_in // In seconds
};