Dragonfly supports three auth types. Whichever you choose, the secret half is stored in VS Code secure storage, never written into a collection file on disk.
Auth types
Bearer Token
Sends an Authorization: Bearer header with your token.
API Key
Sends your key in a header or query parameter.
Basic Auth
Sends a username and password using HTTP Basic authentication.
How secrets are stored
Secrets are handled differently from the rest of a request:
- The non-secret parts of a request live in VS Code storage with the collection
- The secret half, such as a token or password, goes into VS Code secure storage
- Secrets are never written into a collection JSON file
This means you can share or export a collection without leaking live credentials. When you import a collection, live credentials are left out on purpose for the same reason.
Because secrets are kept in VS Code secure storage, they are tied to your machine and are not part of an exported collection. Re-enter them after importing a collection elsewhere.
