Authenticated Scanning

Use this page to scan pages that sit behind a login, such as a patient portal, account dashboard, or booking flow that a normal crawl can't reach.

Why authenticated scanning

The Web Scanner discovers pages by following links from your homepage and your sitemaps. Anything behind a login wall isn't reachable that way, so those pages are invisible to a standard scan, even though they're often exactly where an unexpected tracker carries the most risk.

Authenticated scanning solves this by passing a request header or cookie along with the crawl, the same way your browser would after you sign in.

How it works

Rather than storing a standing username and password, you supply a short-lived credential, an access token or session cookie your own systems issue, that's valid only long enough to complete one scan.

• Header or cookie. Send an Authorization header, a session cookie, or another first-party header your application checks.
• Time-boxed. Every credential you supply has an expiration you set, from 1 to 24 hours.
• Scoped to your domain. A header credential is sent only to the monitor's root domain and its subdomains, never to third-party requests the crawler encounters along the way.
• Not retained. Credentials apply to that scan only. They aren't returned by the API or included in scan results, and any cookie you supply as a credential is excluded from the cookies the scan reports.

The scanner doesn't sign in, submit a login form, or complete multi-factor authentication on your behalf. Your own systems remain responsible for issuing each fresh credential.

Running an authenticated scan

Authenticated scans run through the platform API rather than a scheduled crawl, since a fresh credential needs to be supplied each time. A typical setup:

1. Set the monitor's scan schedule to manual, so scheduled crawls don't run without a credential.
2. Have your own scheduler or script obtain a fresh access token or session cookie immediately before each run.
3. Call the authenticated scan endpoint with that credential.

curl --request POST \
  --url "https://app.oursprivacy.com/rest/v1/web-scanners/WEB_SCANNER_ID/authenticated-scan" \
  --header "Authorization: Bearer YOUR_OURS_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "expiresInHours": 2,
    "credentials": [
      {
        "location": "header",
        "name": "Authorization",
        "value": "Bearer YOUR_FRESH_ACCESS_TOKEN"
      }
    ]
  }'

Use location: "header" for a first-party request header, or location: "cookie" for a browser cookie. Include any required value prefix, such as Bearer . You can supply multiple credentials in the same call if a page needs more than one.

Note: This is a beta capability. Reach out to your account representative or support@oursprivacy.com if you'd like help wiring up your scheduler.

Next Steps

• Scan schedule
• Scanner configuration
• Allowing the scanner through a firewall