Most modern APIs require authentication. To monitor these endpoints, your monitoring tool must authenticate correctly. Misconfiguration returns 401/403 errors that mask real problems.
MoniTao supports all common authentication methods: Bearer Token, OAuth 2.0, API Key in header or query parameter, and Basic Auth. This guide helps you configure monitoring for each type.
Supported Authentication Types
- Bearer Token: Authorization: Bearer {token} header. Used by most modern REST APIs. Token usually long-lived or JWT.
- OAuth 2.0: Authentication via access_token with automatic refresh. More complex but more secure for integrations.
- API Key: Simple key passed as header (X-API-Key) or query parameter (?api_key=xxx). Simple but less secure.
- Basic Auth: Authorization: Basic base64(user:password) header. Old standard, still used for some internal APIs.
Configure Monitoring by Type
- Static Bearer/API Key: add the header directly in MoniTao check configuration.
- OAuth with refresh: configure token endpoint and MoniTao will handle refresh automatically.
- Key rotation: use webhooks to automatically update credentials after rotation.
Best Practices
- Dedicated credentials: create monitoring-specific credentials with minimal permissions (read-only).
- Expiration alerts: configure alerts before token/key expiration to avoid false positives.
Frequently Asked Questions
Which auth method is most secure?
OAuth 2.0 with short-lived tokens and refresh is the current standard for integrations.
How to handle API key rotation?
MoniTao supports webhooks to automatically update credentials after rotation.
Can I monitor an API without credentials?
Only if it has public endpoints. Otherwise you'll only get 401 errors.
How to test my authentication?
Use MoniTao's "Test Check" function which displays status code and response headers.
Ready to Sleep Soundly?
Start free, no credit card required.