Auth and API Testing
Woes can store source auth configuration and run guarded endpoint tests so support teams can validate API behavior while keeping credentials out of source content and model context.Auth Principles
- Credentials are configured separately from documentation content.
- Secret values are never returned in plaintext.
- Secrets are encrypted or handled server-side through the source auth store.
- Test execution applies credentials server-side only.
- Results are sanitized before display.
- Unsafe or uncontrolled targets are blocked by route-level safeguards.
Supported Auth Modes
Source auth can represent common API authentication patterns, including bearer tokens, API keys in headers or query parameters, basic auth, OAuth-style token fields, custom headers, and mTLS configuration metadata. mTLS credentials can be configured, but live mTLS transport is not enabled yet.Configure Source Auth
1
Open the source
Go to Context and open the API source.
2
Open auth settings
Choose the auth type and fill the required fields.
3
Save safely
Leaving a secret field unchanged should preserve the stored secret.
4
Run a test
Use a safe endpoint and inspect the status, latency, sanitized headers, sanitized body, and validation details.
Test Result Fields
Live Test Guardrails
Live tests are authenticated operator actions that requirecontext.test.execute. They are limited to discovered server or endpoint
origins for the source, run through SSRF-safe fetch, block private, loopback, and
reserved hosts plus unsafe ports, and disable redirects for credentialed live
calls.
Woes returns redacted URLs, headers, bodies, previews, and generated curl
commands. Source test payloads are bounded, and live API checks are tracked in
billing usage when a guarded test executes.
Support-agent live verification uses the same guarded execution boundary. It
only runs after explicit customer run/confirm intent, only against concrete
retrieved endpoints, uses configured source auth, defaults to read-safe
behavior, requires write opt-in for unsafe methods, and shows redacted body
previews only in operator/Sandbox contexts.