djangodjango-rest-frameworkdrf-spectacular

Authorization header is not sending when using Swagger documentation on drf-spectacular


I'm using drf-spectacular to document and test my endpoint. My code look like this:

@extend_schema(
    parameters=[
        OpenApiParameter(name='Authorization', description='Authorization token', required=True, type=str, location=OpenApiParameter.HEADER),
        OpenApiParameter(name='my-key1', description='My key 1 info', required=True, type=str, location=OpenApiParameter.HEADER),
        OpenApiParameter(name='my-key2', description='My key 2 info', required=True, type=str, location=OpenApiParameter.HEADER),
    ],
    description='Info about the endpoint',
    responses={
        200: inline_serializer(
                name='Successfull response',
                fields={
                    "result_code": serializers.IntegerField(default=200),
                    "result_description": serializers.CharField(default="Transaccion Exitosa"),
                    "data": DocumentSerializer(many=True),
                }
            ),                         
    },
)
@api_view(["GET"])
def my_endpoint_function(request):
    pass

As you can see I'm declaring 3 headers parameters, Authorization, my-key1 and my-key2. But when I try to use the Swagger documentation only my-key1 and my-key2 are sending. Here's an example:

enter image description here

As you can see in the Swagger documentation I'm sending the three headers I mentioned above, but in the curl only two of them are sending. Does anyone know how to fix this? I need to test my endpoints in the documentation. Thank you for your time.


Solution

  • You need to use the "Authorize" button that is at the top right of the screen, above all the endpoints. This will set the Authorization header and save it for all future requests.

    About the Authorize feature:

    If you have custom authentication (or from a package that spectacular doesn't support yet, like knox) you'll need to add an adapter manually as documented in the customization section. You can import your overrides in one of your App.ready functions.

    class MyAuthenticationScheme(OpenApiAuthenticationExtension):
        target_class = 'my_app.MyAuthentication'  # full import path OR class ref
        name = 'MyAuthentication'  # name used in the schema
    
        def get_security_definition(self, auto_schema):
            return {
                'type': 'apiKey',
                'in': 'header',
                'name': 'api_key',
            }
    

    This screenshot contains both a custom integration, as well as the built-in BasicAuthentication. If you are doing a custom token based scheme I would say to copy one of the base extentions and modify.

    Authorize Button

    Available Authorizers