An unauthenticated scan tests your login page and very little else. Auth profiles are saved sets of credentials that Vooki Pro attaches to scan traffic, reusable across every scan and schedule for an application. If a token changes, you edit one profile instead of every scan that used it.

Create a profile

1. Open Config → Auth Profiles in the sidebar.
2. Click Add, name the profile, and pick a type.
3. Fill in the fields. Secret fields are masked.
4. Save. The profile now appears on the Auth step of both the web and API scan wizards.

Supported types

SSO or a complicated login? Record yourself logging in (see browser recordings) and choose Create a cookie auth profile from the recording. You can also pick Login via recording directly on the scan's Auth step.

Use a profile

• Web scans: select it on the Auth step of the wizard.
• API projects: apply it in bulk to the whole collection.
• CLI: the exported config carries an auth block. Replace secrets with ${ENV_VAR} placeholders.

Getting it right

• Use a dedicated test account. The scanner submits forms, changes data and tries to escalate privileges. Never use a real user's account.
• Exclude the logout URL (for example */logout), or the scanner will log itself out mid-scan.
• Check the token lifetime. A one-hour token on a four-hour scan means most of the scan runs unauthenticated. Use OAuth2 client credentials, a longer-lived test token, or enable Auto re-login.
• Verify before you scan. Send one request in the API Builder with the profile applied and confirm you get a 200, not a 401.

Full reference: Auth profiles (docs)