HTTP Developer Tools API: Download a File

The name of the header or query parameter, e.g. X-API-Key or api_key

The API key value. Stored encrypted.

Stored encrypted.

e.g. us-east-1

e.g. execute-api, s3

Optional — for temporary STS credentials

Stored encrypted.

The bearer token to send in the Authorization header. Stored encrypted.

Stored encrypted.

Stored encrypted.

The response header name the computed signature is sent in, e.g. X-Signature.

Optional prefix, e.g. sha256=

Optional — when set, a unix-seconds timestamp is signed and sent in this header, e.g. X-Timestamp

Client certificate (PEM)

Client private key (PEM)

Optional — only needed if the private key above is encrypted. Stored encrypted.

Optional — pin the server CA (PEM)

The OAuth 2.0 authorization endpoint URL (e.g. https://auth.example.com/oauth/authorize). Must be a public HTTPS URL — internal/private addresses are rejected.

The OAuth 2.0 token endpoint URL (e.g. https://auth.example.com/oauth/token). Must be a public HTTPS URL — internal/private addresses are rejected.

The OAuth 2.0 client ID issued by the authorization server.

The OAuth 2.0 client secret issued by the authorization server. Stored encrypted — never exposed in blueprints or logs.

How to send the client ID and secret to the token endpoint. 'Client Secret Post' puts them in the request body (default, most compatible). 'Client Secret Basic' sends them as an HTTP Basic Authorization header instead.

Space- or comma-separated list of OAuth 2.0 scopes to request (e.g. read write or openid profile). Optional — leave blank if the server grants a default scope.

Optional audience parameter sent in the token request (used by some providers such as Auth0).

Controls whether the authorization server prompts the user for reauthentication or consent. 'consent' forces the consent screen (required by Google to receive a refresh_token with offline access). 'select_account' lets the user pick which account to use.

Google-specific: set to 'offline' to receive a refresh_token that allows renewing access without user interaction. Requires prompt=consent on the first authorization. Leave as 'Default' for providers that do not use this parameter.

Additional query parameters to append to the authorization URL. Use this for provider-specific parameters not covered by the fields above (e.g. hd=example.com for Google Workspace domain hint).

Additional key/value parameters to include in the token-exchange request BODY (urlencoded). Use for provider-specific fields not covered above (e.g. a resource or tenant parameter). Sent when exchanging the authorization code for tokens.

Additional key/value query-string parameters appended to the token-exchange request URL. Rare, but some providers require params in the query string rather than the body.

Additional key/value parameters to include in the token REFRESH request BODY (urlencoded). Sent each time the access token is renewed.

Additional key/value query-string parameters appended to the token REFRESH request URL.

The OAuth 2.0 token endpoint URL (e.g. https://auth.example.com/oauth/token). Must be a public HTTPS URL — internal/private addresses are rejected.

The OAuth 2.0 client ID issued by the authorization server.

The OAuth 2.0 client secret issued by the authorization server. Stored encrypted — never exposed in blueprints or logs.

Space- or comma-separated list of OAuth 2.0 scopes to request (e.g. read write). Optional — leave blank if the server grants a default scope.

Optional audience parameter sent in the token request (used by some providers such as Auth0).

How to send the client ID and secret to the token endpoint. 'Client Secret Post' puts them in the request body (default, most compatible). 'Client Secret Basic' sends them as an HTTP Basic Authorization header instead.