> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/pensarai/apex/llms.txt > Use this file to discover all available pages before exploring further. # pensar auth > Authenticate to target applications and verify authentication mechanisms The `pensar auth` command automates authentication to web applications, handling login flows, token verification, and auth mechanism discovery. ## Synopsis ```bash theme={null} pensar auth --target [options] ``` ## Description The auth command helps you: * Automatically authenticate to applications * Discover authentication mechanisms * Verify bearer tokens and API keys * Test existing session cookies * Export authentication data for pentesting Authentication data is securely stored and never exposed to AI models. Only authentication results and metadata are processed by AI. ## Required Arguments Target URL to authenticate against. ```bash theme={null} pensar auth --target https://app.example.com ``` Should point to the application's authentication endpoint or base URL. ## Authentication Options Username for login. ```bash theme={null} pensar auth --target https://app.example.com --username admin ``` Used for form-based or API authentication. Password for login. ```bash theme={null} pensar auth \ --target https://app.example.com \ --username admin \ --password SecurePass123 ``` Passwords are never sent to AI models. They're only used by browser automation tools. API key for authentication. ```bash theme={null} pensar auth \ --target https://api.example.com \ --api-key sk-1234567890abcdef ``` Tests API key authentication schemes. Bearer token to verify. ```bash theme={null} pensar auth \ --target https://api.example.com \ --bearer "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." ``` Verifies an existing JWT or bearer token. Existing session cookies to verify. ```bash theme={null} pensar auth \ --target https://app.example.com \ --cookies "session=abc123; user_id=456" ``` Tests if existing cookies grant authenticated access. ## Configuration Options AI model to use for authentication discovery. ```bash theme={null} pensar auth --target ... --model claude-opus-4 ``` Disable browser automation tools. ```bash theme={null} pensar auth --target ... --username ... --password ... --no-browser ``` Forces API-based authentication only (faster but may not work for complex login flows). Only discover authentication requirements without attempting login. ```bash theme={null} pensar auth --target https://app.example.com --discover-only ``` Useful for understanding auth requirements before providing credentials. ## Examples ### Discover Authentication Learn what authentication is required: ```bash theme={null} pensar auth --target https://app.example.com --discover-only ``` ``` ========================================================== AUTHENTICATION DISCOVERY ========================================================== Target: https://app.example.com → Analyzing authentication mechanisms... ✓ Detected: Form-based login Login URL: https://app.example.com/login Fields: username, password Method: POST → Additional requirements: - CSRF token required - reCAPTCHA present (may need manual bypass) To authenticate: pensar auth \ --target https://app.example.com \ --username \ --password ``` ### Form-Based Login Authenticate with username/password: ```bash theme={null} pensar auth \ --target https://app.example.com \ --username testuser \ --password testpass123 ``` ``` ========================================================== AUTHENTICATION ========================================================== Target: https://app.example.com Method: Form-based login Username: testuser → Navigating to login page... ✓ Found login form → Filling credentials... → Submitting form... ✓ Login successful → Extracting session data... ✓ Session cookies captured ✓ Auth tokens extracted Authentication data saved to: ~/.pensar/auth/app.example.com/session.json Exported data: - Cookies: session=..., csrf_token=... - Headers: Authorization: Bearer eyJ... - Valid until: 2024-03-05 18:30:00 UTC Use this session for pentesting: pensar pentest --target https://app.example.com --auth-file ~/.pensar/auth/app.example.com/session.json ``` ### API Key Verification Test if an API key is valid: ```bash theme={null} pensar auth \ --target https://api.example.com \ --api-key sk-1234567890abcdef ``` ### Bearer Token Verification Verify a JWT token: ```bash theme={null} pensar auth \ --target https://api.example.com \ --bearer "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" ``` ``` ========================================================== TOKEN VERIFICATION ========================================================== Target: https://api.example.com → Testing bearer token... ✓ Token is valid → Decoding JWT... Token details: - Algorithm: HS256 - Subject: 1234567890 - Name: John Doe - Issued: 2018-01-18 01:30:22 UTC - Expires: Not set (does not expire) Permissions: - Access to: /api/users, /api/posts - Role: admin ⚠ Warning: Token does not expire (security risk) ``` ### Session Cookie Verification Test existing cookies: ```bash theme={null} pensar auth \ --target https://app.example.com \ --cookies "session_id=abc123xyz; remember_token=def456" ``` ### OAuth Authentication For OAuth flows, use discovery first: ```bash theme={null} # Discover OAuth requirements pensar auth --target https://app.example.com --discover-only # Follow instructions for OAuth (browser-based flow) pensar auth --target https://app.example.com ``` ## Authentication Methods Supported Traditional HTML form login: ```bash theme={null} pensar auth \ --target https://app.example.com \ --username user \ --password pass ``` Handles: * CSRF tokens * Hidden form fields * POST/GET methods * Session cookies REST API authentication: ```bash theme={null} pensar auth \ --target https://api.example.com \ --username user \ --password pass ``` Sends JSON: ```json theme={null} POST /api/auth/login {"username": "user", "password": "pass"} ``` JWT or bearer token verification: ```bash theme={null} pensar auth \ --target https://api.example.com \ --bearer "eyJ..." ``` Tests: * Token validity * Expiration * Permissions * Signature API key authentication: ```bash theme={null} pensar auth \ --target https://api.example.com \ --api-key "sk-123..." ``` Tests various header formats: * `Authorization: Bearer sk-123` * `X-API-Key: sk-123` * `api_key=sk-123` (query param) OAuth flows (browser required): ```bash theme={null} pensar auth --target https://app.example.com ``` Opens browser for: * Authorization code flow * Implicit flow * PKCE flow ## Use Cases Get auth data before running pentest Verify JWT tokens and API keys Test OAuth and complex auth flows Reuse sessions across multiple pentests ## Exported Authentication Data Authentication data is saved to `~/.pensar/auth//session.json`: ```json theme={null} { "target": "https://app.example.com", "method": "form-based", "authenticated": true, "cookies": { "session": "abc123...", "csrf_token": "xyz789..." }, "headers": { "Authorization": "Bearer eyJ..." }, "expires": "2024-03-05T18:30:00Z", "permissions": ["read:users", "write:posts"] } ``` Use in pentest: ```bash theme={null} pensar pentest \ --target https://app.example.com \ --auth-file ~/.pensar/auth/app.example.com/session.json ``` ## Troubleshooting Common causes: 1. **Incorrect credentials** - Verify username/password 2. **CAPTCHA present** - May require manual solving 3. **Rate limiting** - Target may block automated login 4. **MFA required** - See [Authentication Guide](/guides/authentication) for MFA support Check: ```bash theme={null} # Verify token format echo "$TOKEN" | base64 -d # Check if token is expired # (JWT expiration is in 'exp' claim) ``` Use [jwt.io](https://jwt.io) to decode and inspect tokens. Try without browser: ```bash theme={null} pensar auth \ --target ... \ --username ... \ --password ... \ --no-browser ``` Or ensure browser dependencies are installed: ```bash theme={null} pensar doctor ``` ## Next Steps Learn about advanced auth scenarios Use auth data for authenticated pentesting Manage authentication sessions Programmatic authentication API