Configure Authentication for a Target

1. In the Add/Verify Parameters page, select an Authentication Method.

   AI Red Teaming supports three authentication methods:

   • Using Headers—Uses static header-based authentication for APIs that accept long-lived credentials such as API keys or bearer tokens. Configure the required authentication headers using the HTTP Headers configuration on the Add/Verify Parameters page.

   • Using Payload—Credentials are included directly in the JSON request body alongside the prompt. Use this mode when your API expects username and password fields in the request payload rather than in HTTP headers. Include these credentials in the JSON request body on the Verify & Edit JSON page.

   • OAuth 2.0—Use OAuth 2.0 client credentials flow for APIs that issue short-lived access tokens.
     For OAuth2-based authentication, AI Red Teaming automatically refreshes access tokens before they expire, ensuring uninterrupted scan execution without manual intervention.
     AI Red Teaming automatically manages the OAuth 2.0 token lifecycle:
     1. Token acquisition—Requests an access token from the OAuth 2.0 token endpoint using client credentials.
     2. Token caching—Stores the token in memory with a time-to-live (TTL) based on the configured expiry duration.
     3. Proactive refresh—Refreshes the token 5 minutes before expiry to prevent authentication failures during scans.
     4. Reactive refresh—If a request fails with an authentication error (HTTP 401 or 403), AI Red Teaming invalidates the cached token, requests a new one, and retries the request automatically.
     This ensures continuous scan execution without authentication interruptions.
     You can configure OAuth 2.0 parameters using one of two methods:
     • Import from cURL—Select Configure OAuth via cURL and paste a cURL command string to automatically populate the OAuth 2.0 configuration fields.

     • Manual configuration—Enter each OAuth 2.0 parameter individually. This method provides full control over the configuration and is suitable when you need to customize the token request format or when a cURL example is not available.
     OAuth 2.0 Configuration Parameters

     OAuth 2.0 Configuration Parameters	Description
     Token URL	OAuth2 authorization server endpoint that issues access tokens. This is typically provided by your identity provider or API documentation. Examples: Azure Entra ID: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token Databricks: https://{workspace}.cloud.databricks.com/oidc/v1/token
     Token Expiry (in minutes)	Specifies how long the access token remains valid (in minutes). AI Red Teaming uses this value to calculate when to refresh the token. Most providers issue tokens with 60-minute validity, but you should configure this based on your provider's token lifetime.
     Token Request Headers	HTTP headers sent when requesting a token. Common headers include: Content-Type: application/x-www-form-urlencoded—Required by most OAuth2 providers per RFC 6749. Authorization: Basic <credentials>—Some providers require client credentials in the header rather than the body.
     Token Request Body Parameters	Form-encoded or JSON parameters sent in the token request. AI Red Teaming supports arbitrary nested JSON structures to accommodate different provider requirements. Common parameters include: grant_type—OAuth2 grant type. client_id—Application or service principal identifier. client_secret—Application or service principal secret. scope—Permissions requested for the access token.
     Token Response Key	After requesting a token, the OAuth2 provider returns a JSON response containing the access token. You configure Token Response Key, the JSON field path where the access token is located in the response. AI Red Teaming supports dot notation for nested fields. Example response: { "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi...", "token_type": "Bearer", "expires_in": 3600 } For this response, the token response key is access_token.
     Inject Token as Header	Once AI Red Teaming obtains an access token, it injects the token into requests sent to the target API. You configure: Header Name—The HTTP header where the token is injected. This is typically Authorization, but some APIs use custom headers like X-Access-Token or Proxy-Authorization. Header Value Template—A template string that defines how the token is formatted in the header. Use the {TOKEN} placeholder where the actual access token should be inserted. Common templates: Bearer {TOKEN}—Standard OAuth2 bearer token format (most APIs). {TOKEN}—Raw token without prefix. Token {TOKEN}—Custom prefix. Example: If the template is Bearer {TOKEN} and the access token is abc123, AI Red Teaming injects the header Authorization: Bearer abc123.

     You must successfully configure authentication settings before proceeding to the next configuration steps.
2. (Optional) Register your application on Microsoft Entra for AI Red Teaming to use Azure Entra ID with OAuth 2.0 client credentials authentication.
3. Return to the Verify & Edit JSON step to complete the remaining target configuration steps.