API essentials

Authenticate API requests

Choose the OAuth 2.0 or API-key credential required by a Petstore operation.

Swagger Petstore defines two security schemes. Security is declared per operation, so check the endpoint page before sending a credential.

OAuth 2.0

Pet operations use an OAuth 2.0 implicit flow with this authorization URL:

text

https://petstore3.swagger.io/oauth/authorize

The published scopes are:

Scope	Contract description
`read:pets`	Read your pets
`write:pets`	Modify pets in your account

The pet operations in this contract request both scopes. Send the resulting access token as a bearer credential:

http

Authorization: Bearer example_access_token

⚠️The OpenAPI contract defines an OAuth 2.0 implicit flow, but it does not define token lifetime, refresh behavior, or production credential-management policy. Do not infer those details from this sample API.

API key

The api_key scheme sends its value in the api_key request header:

http

api_key: example_api_key

Get inventory requires this scheme. Get a pet accepts either api_key or OAuth 2.0 according to its alternative security requirements.

Operations without security

Store order and user operations do not declare operation-level security in this contract. That absence describes only the published contract; it is not a general statement about how another Petstore deployment is secured.

Next, review API conventions or open the endpoint you plan to call.