Multiple Security Schemes in one project

[LvckyAPI]

Is it possible to add multiple Security Schemes.

For example.

We have a API that handles login, permissions, and products.

If we want to check logged in user permission we need to make a Request ro our capabilities endpoint using jwt cookie auth

For other stuff like adding a new user via API using a backend or something we need a Bearer Token

So we have

/api/user/capabilities - JWT
/api/user/create - Bearer

[valentinrougier39]

Hi, same questions for me. Someone find a solution to do this ?

[nmedelmehdi]

hi! same issue here, we using a multitenant envirenement, the first header is :
SecurityScheme::apiKey('header', 'X-Tenant')
we need a second attribute to handle jwt auth

[willvincent]

This can be handled by establishing multiple docs, as one would for api versions:

        // Set OpenAPI Docs Security Scheme
        Scramble::afterOpenApiGenerated(function (OpenApi $openApi) {
           $openApi->secure(
               SecurityScheme::http('bearer')
           );
        });

        // Uses api key in the header
        Scramble::registerApi('external_v1', ['info' => [ 'version' => '1.0']])
            ->routes(function (Route $route) {
                return Str::startsWith($route->uri, 'api/external/v1/');
            })
            ->afterOpenApiGenerated(function (OpenApi $openApi) {
                $openApi->secure(
                    SecurityScheme::apiKey('header', 'x-api-key')
                );
            });
        Scramble::registerUiRoute(path: 'docs/ext-v1', api: 'external_v1');
        Scramble::registerJsonSpecificationRoute(path: 'docs/ext-v1.json', api: 'external_v1');

        // Uses the default bearer token defined earlier
        Scramble::registerApi('v1', ['info' => [ 'version' => '1.0']])
            ->routes(function (Route $route) {
                return Str::startsWith($route->uri, 'api/v1/');
            });
        Scramble::registerUiRoute(path: 'docs/v1', api: 'v1');
        Scramble::registerJsonSpecificationRoute(path: 'docs/v1.json', api: 'v1');

However, if you don't want them in separate docs, it would certainly be nice to be able to set alternate security scheme info on a route or route group. Maybe attributes are the cleanest way forward?

[LvckyAPI]

Yes, I don't want them in a different docs.
Attributes are the prefered way