> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apyguard.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Authorization Settings
> Create and manage authorization settings in ApyGuard to control how scans authenticate and evaluate protected API behavior.
## Overview
Authorization settings define how ApyGuard gains access to protected endpoints during testing. They connect authentication method, token behavior, credentials, and role-based expectations into one reusable configuration.
Choose the auth flow that matches your API, such as Predefined Token, Login URL, OIDC, or OAuth2.
Define token format and where the token should appear in requests.
Attach the credential records needed to authenticate successfully.
Support authorization matrix testing for different access levels and API behaviors.
## Typical setup flow
1. Create a new authorization setting.
2. Choose the correct authentication method.
3. Add or select credentials.
4. Configure token format and token location.
5. Review server-detected metadata for OIDC or OAuth2 flows.
6. Adjust authorization matrix for your discovered endpoints
## Related pages
* [Authentication Overview](/authentication/overview)
* [Credentials](/core-workflows/credentials)
* [Login URL](/authentication/login-url)