Authentication Protocol¶
The Authentication Protocol fieldset selects how QIE authenticates to the endpoint. For the Google Cloud Healthcare API type this fieldset is replaced by a Google-specific authentication section (see Google Cloud Healthcare API authentication below).
Authentication¶
Selects the authentication scheme. The fields that follow depend on the choice.
| Option | When to use |
|---|---|
| API key | A single secret token sent as a header or query parameter |
| Basic | HTTP Basic authentication (username / password) |
| OAuth2 with Credentials | OAuth2 client_credentials, password, or similar grant types |
| OAuth2 with JWT | OAuth2 jwt-bearer grant signed by a private key |
| OAuth2 with JWT (Azure) | OAuth2 jwt-bearer grant against Microsoft Entra ID / Azure AD |
| AWS Signature | AWS SigV4 (used by AWS HealthLake, API Gateway, etc.) |
The remaining authentication fields depend on the Authentication value.
API Key¶
The secret API key. QIE sends this value in whatever header or parameter the endpoint expects; configure that placement using a Static HTTP Header if a fixed header is required.
Username and Password¶
The credentials sent in the HTTP Basic Authorization header.
Send username and password only when challenged¶
When checked, QIE omits the Authorization header on the initial request and only sends credentials after receiving an HTTP 401 challenge. When unchecked (the default), QIE sends credentials preemptively on every request.
Username and Password¶
The credentials passed in the token request (for example, as username / password in the request payload).
Method¶
GET or POST. The HTTP method used when requesting the access token from the Auth URL. Selecting POST reveals the Content-Type and Payload fields.
Auth URL¶
The token-issuing endpoint URL.
Content-Type¶
(POST only) The Content-Type of the token request body, usually application/x-www-form-urlencoded or application/json. Either choose a value from the drop-down or type a custom value.
Payload¶
(POST only) The body of the token request. QIE substitutes {ws-user:self} and {ws-pass:self} with the configured Username and Password, and supports other placeholders for parameter-driven payloads.
Token Path¶
The JSON node path of the access token in the token-server response (for example, /access_token). The drop-down offers common values like /access_token, /token, /oauth/token, /oauth2/v2.0/token; any path can be typed in.
Token Refresh¶
Selects how QIE decides when to refresh the access token. The choice controls which Refresh Token Configuration fields appear (see below).
- Refresh upon failure: only request a new token after a call fails with an authentication error.
- Refresh after fixed time: request a new token at a fixed interval.
- Refresh when token expires: read the token's expiration from a JSON node path in the token-server response.
- Refresh based on token: use the refresh-token grant flow to obtain a new access token before the current one expires.
Include Basic Authentication in Header?¶
When checked, QIE adds an HTTP Basic Authorization header containing the configured username and password to the token request. Some token servers (e.g. those expecting client_id / client_secret as Basic Auth) require this.
Static OAuth2 HTTP Headers¶
Opens a dialog for headers that are sent only with the OAuth2 token request, distinct from the per-call Static HTTP Headers above. A common example is Accept: application/json to force the token server to return JSON when it supports multiple response formats. As with the per-call headers, values are literal strings (no placeholder substitution) and the Authorization, Content-Type, and Content-Length headers are managed by QIE. Do not list them here.
Test OAuth¶
Submits a test token request using the current configuration and displays the resulting logs, caches, and script variables. Save any pending changes before running the test.
Signing Cert¶
The private key QIE uses to sign the JWT. Keys are managed on the Certificate Management page.
Generate x5t / Generate x5c¶
Helper buttons that compute and insert the X.509 thumbprint (x5t) or certificate chain (x5c) for the selected Signing Cert into the Token Config JSON.
Token Config¶
The JSON definition of the JWT header and body. Items marked Set by JWT are populated automatically at sign time (nbf, iat, etc.); the other claims come from the configured value. Standard claims may be removed and non-standard claims added as the token server requires.
The default template differs slightly between OAuth2 with JWT and OAuth2 with JWT (Azure). The Azure template pre-fills kid and x5t hints specific to the Microsoft Entra ID app-registration manifest.
Token Server¶
The URL of the OAuth2 token endpoint that exchanges the signed JWT for an access token.
Token Content¶
The body of the token request. The placeholder {p:jwt_token} is replaced with the encoded JWT at request time. The default grant is grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={p:jwt_token}.
Token Preview¶
A read-only one-line preview of the resolved token-content string for visual confirmation. Edit the Token Content rows to change it.
Static OAuth2 HTTP Headers¶
Opens a dialog for headers that are sent only with the OAuth2 token request. See the OAuth2 with Credentials variant above for the same notes about literal values and reserved header names.
Test OAuth¶
Submits a test token request using the current configuration and displays the result.
Use the AWS Credentials Provider¶
When checked, QIE uses the AWS default credentials-provider chain (instance profile, container role, environment, etc.) to sign requests. The Username and Password fields are disabled. This option requires QIE itself to be running in AWS. See the AWS ECS Install Guide.
Username and Password¶
(When the credentials provider is not used) The AWS access key ID (Username) and secret access key (Password) used to sign requests.
AWS Region¶
The AWS region the signed request is targeting (for example, us-east-1). Required, because AWS SigV4 binds the signature to a specific region.
AWS Service¶
The AWS service identifier in the SigV4 credential scope (for example, healthlake or execute-api). Required.
Refresh Token Configuration¶
Visible only when Authentication is OAuth2 with Credentials and Token Refresh is something other than Refresh upon failure. The fields shown depend on the refresh mode.
Refresh token after <N> seconds¶
(Refresh after fixed time mode) The fixed interval between refreshes. QIE requests a new token every N seconds regardless of the previous token's stated lifetime. Maximum 86400 (24 hours).
Expire Path¶
(Refresh when token expires or Refresh based on token modes) The JSON node path in the token-server response that holds the token lifetime in seconds (typically /expires_in). QIE refreshes the token just before it would expire.
Refresh Token¶
(Refresh based on token mode) The JSON node path in the token-server response that holds the refresh-token value (typically /refresh_token).
Refresh URL¶
(Refresh based on token mode) The URL QIE calls to exchange the refresh token for a new access token. May be the same as the initial Auth URL or a separate endpoint.
Refresh Payload¶
(Refresh based on token mode, POST only) The body of the refresh request. QIE substitutes {ws-refresh-token:self} with the currently cached refresh-token value.
Google Cloud Healthcare API authentication¶
When the connection Type is Google Cloud Healthcare API, the standard Authentication Protocol fieldset is replaced by these Google-specific fields.
JSON Key File¶
Paste the service-account JSON key file downloaded from the Google Cloud Console. The toolbar's Validate Key File button verifies the key without saving the connection. The View JWT Config button opens the parsed JWT configuration the key generates. When a valid key file is pasted, QIE auto-populates Project Id, Token Server, and Token Content from its contents.
Project Id¶
The Google Cloud project ID, read from the JSON Key File. Read-only.
Token Server¶
The Google OAuth2 token endpoint, read from the JSON Key File. Read-only.
Token Content¶
The grant payload QIE sends to Google's token server, read from the JSON Key File. Read-only. The placeholder {p:jwt_token} is replaced with the encoded JWT at request time.