New Fluxzy v2 just shipped. Electron is out, Tauri is in. gRPC ready, 3x smaller install. Learn more

addAuthorizationBearerAction Action

Attach an OAuth or JWT bearer token to outgoing requests from a rule, so the client never has to handle the credential itself.

Bearer tokens drive most modern APIs, and most tools that capture HTTP traffic still leave token handling to the client. Fluxzy lets you push that responsibility into the proxy, which means scripts and apps can talk to OAuth gated services without ever knowing about the token, and you can swap identities with a single edit to a YAML file.

When to use this action

Use addAuthorizationBearerAction when an upstream API expects an Authorization: Bearer <token> header and you want Fluxzy to attach it instead of the client. This is especially useful when the token is short lived or rotated by a separate process.

Typical situations include:

  • Calling a protected REST or GraphQL API from a script, browser, or mobile app that does not implement the OAuth dance.
  • Comparing the behaviour of an API under different identities by swapping the token in one place.
  • Debugging an SDK by isolating the network layer from the token acquisition layer.

The action evaluates on requestHeaderReceivedFromClient. Combine it with a hostFilter so the token never leaves the intended domain.

Real world examples

Inject a JWT for a single API

Scope the token to the API host so it never reaches third party services. Useful when reverse engineering a public web app that calls a token gated backend.

rules:
- filter:
    typeKind: HostFilter
    pattern: api.payments.example.com
  actions:
  - typeKind: AddAuthorizationBearerAction
    token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.payload.signature

Use a different token for staging versus production

Two rules with different host filters keep the right credential on the right environment, no client code change required.

rules:
- filter:
    typeKind: HostFilter
    pattern: staging-api.example.com
  actions:
  - typeKind: AddAuthorizationBearerAction
    token: staging-token-here
- filter:
    typeKind: HostFilter
    pattern: api.example.com
  actions:
  - typeKind: AddAuthorizationBearerAction
    token: production-token-here

Inject only when the client did not send a token

Combine with the negation of hasAuthorizationBearerFilter to only add a token when one is missing, leaving authenticated clients untouched.

rules:
- filter:
    typeKind: FilterCollection
    operation: And
    children:
    - typeKind: HostFilter
      pattern: api.example.com
    - typeKind: HasAuthorizationBearerFilter
      inverted: true
  actions:
  - typeKind: AddAuthorizationBearerAction
    token: fallback-development-token

Reference

addAuthorizationBearerAction

Description

Add Authorization Bearer token to the request header.

Evaluation scope

Evaluation scope defines the timing where this filter will be applied.

requestHeaderReceivedFromClient This scope occurs the moment fluxzy parsed the request header receiveid from client

YAML configuration name

addAuthorizationBearerAction

Settings

The following table describes the customizable properties available for this action:

Property Type Description DefaultValue
token string

Example of usage

The following examples apply this action to any exchanges

Add Authorization Bearer token to the request header.

rules:
- filter:
    typeKind: AnyFilter
  actions:
  - typeKind: AddAuthorizationBearerAction
    token: your_token_here

.NET reference

View definition of AddAuthorizationBearerAction for .NET integration.

See also

This action has no related action

Frequently asked questions

Does Fluxzy refresh the token automatically when it expires?

No. The token in the YAML is used as is. Pair this action with a build step that fetches a fresh token, writes it into the rule file, and restarts the capture.

Will the action overwrite an existing Authorization header?

It appends a new header. If both headers exist, most servers honour the first. Use deleteRequestHeaderAction first if you need a clean override.

Can I store the token in an environment variable?

Yes. Define a setVariableAction that reads from your environment, then reference the variable in the token field.

Is this safe for production traffic?

It is meant for capture, debugging, and lab use. Anyone with access to the rule file can read the token, so do not commit production credentials to a shared repository.

Learn more about Fluxzy rules