|
1 | | ---- |
2 | | -title: Service endpoint authentication schemes |
3 | | -titleSuffix: Azure DevOps |
4 | | -description: Define authentication schemes for custom service endpoint types in Azure DevOps extensions. |
5 | | -ms.assetid: bffc76b7-f6ba-41f0-8460-ccb44d45d670 |
6 | | -ms.subservice: azure-devops-ecosystem |
7 | | -ms.custom: pat-reduction, UpdateFrequency3 |
8 | | -ms.topic: concept |
9 | | -monikerRange: '<= azure-devops' |
10 | | -ms.author: chcomley |
11 | | -author: chcomley |
| 1 | +--- |
| 2 | +title: Service endpoint authentication schemes |
| 3 | +titleSuffix: Azure DevOps |
| 4 | +description: Define authentication schemes for custom service endpoint types in Azure DevOps extensions. |
| 5 | +ms.assetid: bffc76b7-f6ba-41f0-8460-ccb44d45d670 |
| 6 | +ms.subservice: azure-devops-ecosystem |
| 7 | +ms.custom: pat-reduction, UpdateFrequency3 |
| 8 | +ms.topic: concept |
| 9 | +monikerRange: '<= azure-devops' |
| 10 | +ms.author: chcomley |
| 11 | +author: chcomley |
12 | 12 | ms.date: 04/03/2026 |
13 | | -ai-usage: ai-assisted |
14 | | ---- |
15 | | - |
16 | | -# Service endpoint authentication schemes |
17 | | - |
18 | | -[!INCLUDE [version-lt-eq-azure-devops](../../includes/version-lt-eq-azure-devops.md)] |
19 | | - |
20 | | -When you define a custom service endpoint type in your extension, you specify an authentication scheme that tells Azure DevOps how to set credentials in the HTTP request header. Azure DevOps supports the following authentication schemes for custom endpoints. |
21 | | - |
22 | | -[!INCLUDE [extension-docs-new-sdk](../../includes/extension-docs-new-sdk.md)] |
23 | | - |
24 | | -## Basic authentication |
25 | | - |
26 | | -Uses a username and password sent as a Base64-encoded `Authorization` header. |
27 | | - |
28 | | -> [!IMPORTANT] |
29 | | -> Where possible, use service principals and managed identities instead of basic authentication. For more information, see [Use service principals & managed identities](../../integrate/get-started/authentication/service-principal-managed-identity.md). |
30 | | -
|
31 | | -The built-in scheme type is `ms.vss-endpoint.endpoint-auth-scheme-basic`. You don't need to declare it in your extension manifest — reference it in your endpoint type's `authenticationSchemes` array: |
32 | | - |
33 | | -```json |
34 | | -"authenticationSchemes": [ |
35 | | - { |
36 | | - "type": "ms.vss-endpoint.endpoint-auth-scheme-basic" |
37 | | - } |
38 | | -] |
39 | | -``` |
40 | | - |
41 | | -Azure DevOps prompts the user for **Username** and **Password** and sends them as the standard HTTP Basic `Authorization` header. |
42 | | - |
43 | | -## Token-based authentication |
44 | | - |
45 | | -Takes a single confidential input — an API token. The token value is sent in the `Authorization` header. |
46 | | - |
47 | | -```json |
48 | | -{ |
49 | | - "id": "endpoint-auth-scheme-token", |
50 | | - "description": "i18n:Token based endpoint authentication scheme", |
51 | | - "type": "ms.vss-endpoint.service-endpoint-type", |
52 | | - "targets": [ |
53 | | - "ms.vss-endpoint.endpoint-types" |
54 | | - ], |
55 | | - "properties": { |
56 | | - "name": "Token", |
57 | | - "displayName": "i18n:Token Based Authentication", |
58 | | - "authenticationSchemes": [ |
59 | | - { |
60 | | - "type": "ms.vss-endpoint.endpoint-auth-scheme-token", |
61 | | - "headers": [ |
62 | | - { |
63 | | - "name": "Authorization", |
64 | | - "value": "{{endpoint.apitoken}}" |
65 | | - } |
66 | | - ], |
67 | | - "inputDescriptors": [ |
68 | | - { |
69 | | - "id": "apitoken", |
70 | | - "name": "i18n:API Token", |
71 | | - "description": "i18n:API Token for connection to endpoint", |
72 | | - "inputMode": "textbox", |
73 | | - "isConfidential": true, |
74 | | - "validation": { |
75 | | - "isRequired": true, |
76 | | - "dataType": "string", |
77 | | - "maxLength": 300 |
78 | | - } |
79 | | - } |
80 | | - ] |
81 | | - } |
82 | | - ] |
83 | | - } |
84 | | -} |
85 | | -``` |
86 | | - |
87 | | -The `{{endpoint.apitoken}}` placeholder resolves to the value the user enters in the **API Token** field at runtime. |
88 | | - |
89 | | -## Certificate-based authentication |
90 | | - |
91 | | -Takes a single confidential input — the certificate content, entered in a text area. |
92 | | - |
93 | | -```json |
94 | | -{ |
95 | | - "id": "endpoint-auth-scheme-cert", |
96 | | - "description": "i18n:Creates a certificate-based endpoint authentication scheme", |
97 | | - "type": "ms.vss-endpoint.service-endpoint-type", |
98 | | - "targets": [ |
99 | | - "ms.vss-endpoint.endpoint-types" |
100 | | - ], |
101 | | - "properties": { |
102 | | - "name": "Certificate", |
103 | | - "displayName": "i18n:Certificate Based", |
104 | | - "authenticationSchemes": [ |
105 | | - { |
106 | | - "type": "ms.vss-endpoint.endpoint-auth-scheme-cert", |
107 | | - "inputDescriptors": [ |
108 | | - { |
109 | | - "id": "certificate", |
110 | | - "name": "i18n:Certificate", |
111 | | - "description": "Content of the certificate", |
112 | | - "inputMode": "TextArea", |
113 | | - "isConfidential": true, |
114 | | - "validation": { |
115 | | - "isRequired": true, |
116 | | - "dataType": "string" |
117 | | - } |
118 | | - } |
119 | | - ] |
120 | | - } |
121 | | - ] |
122 | | - } |
123 | | -} |
124 | | -``` |
125 | | - |
126 | | -## No authentication |
127 | | - |
128 | | -Use this scheme when the external service supports anonymous access and no credentials are needed. |
129 | | - |
130 | | -```json |
131 | | -{ |
132 | | - "id": "endpoint-auth-scheme-none", |
133 | | - "description": "i18n:Creates an endpoint authentication scheme with no authentication.", |
134 | | - "type": "ms.vss-endpoint.endpoint-auth-scheme-none", |
135 | | - "targets": [ |
136 | | - "ms.vss-endpoint.endpoint-auth-schemes" |
137 | | - ], |
138 | | - "properties": { |
139 | | - "name": "None", |
140 | | - "displayName": "i18n:No Authentication" |
141 | | - } |
142 | | -} |
143 | | -``` |
144 | | - |
145 | | -## Related content |
146 | | - |
147 | | -- [Service endpoint extensions](../develop/service-endpoints.md) |
148 | | -- [Extension manifest reference](manifest.md) |
149 | | -- [Authenticate and secure web extensions](auth.md) |
| 13 | +ai-usage: ai-assisted |
| 14 | +--- |
| 15 | + |
| 16 | +# Service endpoint authentication schemes |
| 17 | + |
| 18 | +[!INCLUDE [version-lt-eq-azure-devops](../../includes/version-lt-eq-azure-devops.md)] |
| 19 | + |
| 20 | +When you define a custom service endpoint type in your extension, you specify an authentication scheme that tells Azure DevOps how to set credentials in the HTTP request header. Azure DevOps supports the following authentication schemes for custom endpoints. |
| 21 | + |
| 22 | +[!INCLUDE [extension-docs-new-sdk](../../includes/extension-docs-new-sdk.md)] |
| 23 | + |
| 24 | +## Basic authentication |
| 25 | + |
| 26 | +Uses a username and password sent as a Base64-encoded `Authorization` header. |
| 27 | + |
| 28 | +> [!IMPORTANT] |
| 29 | +> Where possible, use service principals and managed identities instead of basic authentication. For more information, see [Use service principals & managed identities](../../integrate/get-started/authentication/service-principal-managed-identity.md). |
| 30 | +
|
| 31 | +The built-in scheme type is `ms.vss-endpoint.endpoint-auth-scheme-basic`. You don't need to declare it in your extension manifest — reference it in your endpoint type's `authenticationSchemes` array: |
| 32 | + |
| 33 | +```json |
| 34 | +"authenticationSchemes": [ |
| 35 | + { |
| 36 | + "type": "ms.vss-endpoint.endpoint-auth-scheme-basic" |
| 37 | + } |
| 38 | +] |
| 39 | +``` |
| 40 | + |
| 41 | +Azure DevOps prompts the user for **Username** and **Password** and sends them as the standard HTTP Basic `Authorization` header. |
| 42 | + |
| 43 | +## Token-based authentication |
| 44 | + |
| 45 | +Takes a single confidential input — an API token. The token value is sent in the `Authorization` header. |
| 46 | + |
| 47 | +```json |
| 48 | +{ |
| 49 | + "id": "endpoint-auth-scheme-token", |
| 50 | + "description": "i18n:Token based endpoint authentication scheme", |
| 51 | + "type": "ms.vss-endpoint.service-endpoint-type", |
| 52 | + "targets": [ |
| 53 | + "ms.vss-endpoint.endpoint-types" |
| 54 | + ], |
| 55 | + "properties": { |
| 56 | + "name": "Token", |
| 57 | + "displayName": "i18n:Token Based Authentication", |
| 58 | + "authenticationSchemes": [ |
| 59 | + { |
| 60 | + "type": "ms.vss-endpoint.endpoint-auth-scheme-token", |
| 61 | + "headers": [ |
| 62 | + { |
| 63 | + "name": "Authorization", |
| 64 | + "value": "{{endpoint.apitoken}}" |
| 65 | + } |
| 66 | + ], |
| 67 | + "inputDescriptors": [ |
| 68 | + { |
| 69 | + "id": "apitoken", |
| 70 | + "name": "i18n:API Token", |
| 71 | + "description": "i18n:API Token for connection to endpoint", |
| 72 | + "inputMode": "textbox", |
| 73 | + "isConfidential": true, |
| 74 | + "validation": { |
| 75 | + "isRequired": true, |
| 76 | + "dataType": "string", |
| 77 | + "maxLength": 300 |
| 78 | + } |
| 79 | + } |
| 80 | + ] |
| 81 | + } |
| 82 | + ] |
| 83 | + } |
| 84 | +} |
| 85 | +``` |
| 86 | + |
| 87 | +The `{{endpoint.apitoken}}` placeholder resolves to the value the user enters in the **API Token** field at runtime. |
| 88 | + |
| 89 | +## Certificate-based authentication |
| 90 | + |
| 91 | +Takes a single confidential input — the certificate content, entered in a text area. |
| 92 | + |
| 93 | +```json |
| 94 | +{ |
| 95 | + "id": "endpoint-auth-scheme-cert", |
| 96 | + "description": "i18n:Creates a certificate-based endpoint authentication scheme", |
| 97 | + "type": "ms.vss-endpoint.service-endpoint-type", |
| 98 | + "targets": [ |
| 99 | + "ms.vss-endpoint.endpoint-types" |
| 100 | + ], |
| 101 | + "properties": { |
| 102 | + "name": "Certificate", |
| 103 | + "displayName": "i18n:Certificate Based", |
| 104 | + "authenticationSchemes": [ |
| 105 | + { |
| 106 | + "type": "ms.vss-endpoint.endpoint-auth-scheme-cert", |
| 107 | + "inputDescriptors": [ |
| 108 | + { |
| 109 | + "id": "certificate", |
| 110 | + "name": "i18n:Certificate", |
| 111 | + "description": "Content of the certificate", |
| 112 | + "inputMode": "TextArea", |
| 113 | + "isConfidential": true, |
| 114 | + "validation": { |
| 115 | + "isRequired": true, |
| 116 | + "dataType": "string" |
| 117 | + } |
| 118 | + } |
| 119 | + ] |
| 120 | + } |
| 121 | + ] |
| 122 | + } |
| 123 | +} |
| 124 | +``` |
| 125 | + |
| 126 | +## No authentication |
| 127 | + |
| 128 | +Use this scheme when the external service supports anonymous access and no credentials are needed. |
| 129 | + |
| 130 | +```json |
| 131 | +{ |
| 132 | + "id": "endpoint-auth-scheme-none", |
| 133 | + "description": "i18n:Creates an endpoint authentication scheme with no authentication.", |
| 134 | + "type": "ms.vss-endpoint.endpoint-auth-scheme-none", |
| 135 | + "targets": [ |
| 136 | + "ms.vss-endpoint.endpoint-auth-schemes" |
| 137 | + ], |
| 138 | + "properties": { |
| 139 | + "name": "None", |
| 140 | + "displayName": "i18n:No Authentication" |
| 141 | + } |
| 142 | +} |
| 143 | +``` |
| 144 | + |
| 145 | +## Related content |
| 146 | + |
| 147 | +- [Service endpoint extensions](../develop/service-endpoints.md) |
| 148 | +- [Extension manifest reference](manifest.md) |
| 149 | +- [Authenticate and secure web extensions](auth.md) |
0 commit comments