Flask RESTPlus swagger interface doesn't pass Authorisation header on to curl request

Question

Running latest (and now old due to the switchover to flask REST-X) flask RESTPlus using the authorization functionality for the swagger interface with a Bearer token as follows:

authorizations = {
'apikey': {
    'type': 'apiKey',
    'in': 'header',
    'name': 'Bearer '
}

But although the "Authorise" box comes up in the swagger interface, and I can put a token in there, it doesn't get added to the requests coming out or the curl format that swagger provides, so we can see clearly it's not being picked up. What's going on here and how do I fix it?

Answer 1

Make sure the code also has annotations that would add security to individual operations or globally. This is needed to actually attach the Authorization header to operations.

In other words, the generated OpenAPI definition should contain the following.

If using OpenAPI 2.0:

swagger: '2.0'

securityDefinitions:
  apikey:
    type: apiKey
    in: header
    name: Authorization

security:
  - apiKey: []

If using OpenAPI 3.0:

openapi: 3.0.0

components:
  securitySchemes:
    apikey:
      type: apiKey
      in: header
      name: Authorization

    # or using OAS3 Bearer auth scheme
    # apiKey:
    #  type: http
    #  scheme: bearer

security:
  - apiKey: []